T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unverified Third-Party npm Package Is Installed and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5`, `SKILL.md:53-59`, `SKILL.md:82-83`; mirrored in `SKILL-cn.md:5`, `SKILL-cn.md:52-58`, and `SKILL-cn.md:81-82` **Vulnerability Type**: Third-party dependency and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:5`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy kling-v3-omni -h for help."}} ``` From `SKILL.md:53-59`: ```bash npx @dlazy/cli@1.2.3 <command> ``` ```text Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` From `SKILL.md:82-83`: ```text **CRITICAL INSTRUCTION FOR AGENT**: Run the `dlazy kling-v3-omni` command to get results. ``` The equivalent installation and execution instructions also appear in `SKILL-cn.md`. ### Technical Analysis The Skill delegates its principal behavior to the external npm package `@dlazy/cli@1.2.3`. Both the global installation command and the `npx` alternative retrieve and execute package content that is not included in the audited project. npm package installation can execute package code and lifecycle scripts with the permissions of the invoking user. The global installation option also modifies the user's or system's executable environment. Pinning the package to version `1.2.3` reduces exposure to unexpected future upgrades, but the Skill does not declare or verify a cryptographic integrity digest for the downloaded artif ...[truncated 2046 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor or otherwise include the exact CLI source and dependency lockfile in the reviewable distribution so its behavior can be audited together with the Skill. 2. Publish and verify a cryptographic digest or signed provenance statement for the exact npm artifact before execution. 3. Retain exact version pinning and also lock all transitive dependencies. 4. Prefer a locally installed, project-scoped dependency over `npm install -g` to reduce persistence and executable-path modification. 5. Disable npm lifecycle scripts where compatible, for example by using an installation process equivalent to `npm install --ignore-scripts`, and explicitly document any scripts that are required. 6. Execute the CLI in a sandbox or container with access limited to explicitly selected input files and output directories. 7. Restrict outbound network access to the documented endpoints, `api.dlazy.com` and `files.dlazy.com`, after verifying that these are sufficient for operation. 8. Avoid exposing unrelated environment variables to the process. Supply the API credential through a narrowly scoped secret mechanism and ensure `~/.dlazy/config.json` has restrictive permissions. 9. Perform recurring source, package-artifact, and transitive-dependency reviews, including npm provenance and publisher-account verification. 10. Clearly warn users that selected local media and prompts are uploaded to a third-party service before invoking the command. ]]>