T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unverified Third-Party CLI Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5`, `SKILL.md:63-69`; mirrored in `SKILL-cn.md:5`, `SKILL-cn.md:63-69` **Vulnerability Type**: Third-party package supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```json metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazyai/cli","source":"https://github.com/dlazyai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy kling-audio-clone -h for help."}} ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ```bash npm install -g @dlazy/cli@1.2.3 ``` ### Technical Analysis The Skill directs the environment to retrieve and execute the external npm package `@dlazy/cli@1.2.3`. Pinning the package version reduces exposure to unexpected upgrades, but the audited project does not contain the CLI source, a package lock file, a cryptographic integrity value, a vendored package, or another mechanism that proves the downloaded artifact corresponds to reviewed source code. Both `npm install -g` and `npx` can execute package lifecycle or runtime code under the privileges of the invoking user. The global installation option additionally leaves the CLI installed after the Skill invocation. The CLI is expected to receive a dLazy API key, read user-selected reference audio, and communicate with external services. Consequently, compromise of the npm account, package artifact, registry delivery path, or referenced release could expose sensitive credentials and biometric audio. This finding identifies a supply-chain trust weakness. The available project files do not establish that the currently published package is malicious. ### Attack Path 1. An attacker compromise ...[truncated 1649 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor and audit the exact CLI source or distributable artifact required by the Skill rather than relying solely on a registry package name and version. 2. Record and verify the npm artifact's cryptographic integrity hash before execution. Use a reviewed lock file or equivalent immutable dependency manifest. 3. Establish provenance verification between the published npm artifact, the referenced GitHub source, and a signed release or reproducible build. 4. Prefer an isolated, non-privileged execution environment with access limited to the specific audio file and configuration required for the operation. 5. Avoid global installation. Prefer an ephemeral environment that is removed after execution and does not modify the user's persistent command path. 6. Disable npm lifecycle scripts where operationally possible, and separately review any lifecycle scripts required by the package. 7. Restrict filesystem access so the CLI cannot read unrelated user files or credentials. 8. Restrict outbound network access to the explicitly documented endpoints, `api.dlazy.com` and `files.dlazy.com`, after confirming all required service hosts. 9. Request explicit user consent before uploading reference audio, clearly identifying the destination, retention policy, and biometric-data implications. 10. Store API credentials using an operating-system credential manager where possible, apply least-privilege scopes, and support prompt rotation and revocation following suspected compromise. ]]>