T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unverified Third-Party CLI Executes with User Privileges<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5,49-55`; mirrored in `SKILL-cn.md:5,49-55` **Vulnerability Type**: Third-party supply-chain exposure **Risk Level**: Medium ### Complete Code Snippet From `SKILL.md`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy kling-v3 -h for help."}} ``` ```markdown You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` The equivalent configuration and commands appear in `SKILL-cn.md`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"当调用此技能时，可以使用 dlazy kling-v3 -h 查看帮助信息。"}} ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ### Technical Analysis The audited project contains only documentation and configuration; it does not contain the implementation of `@dlazy/cli`. Nevertheless, the Skill delegates authentication, API-key storage, local-file processing, uploads, and network communication to th ...[truncated 2550 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Verify package integrity** - Record and validate the registry artifact's cryptographic integrity hash before execution. - Publish verifiable build provenance and signed releases. - Ensure the npm artifact is reproducibly linked to the reviewed source revision. 2. **Audit the complete dependency graph** - Review the source for `@dlazy/cli@1.2.3`, including package lifecycle scripts. - Generate and audit a lockfile or software bill of materials covering all transitive dependencies. - Add automated dependency, malware, provenance, and vulnerability scanning to the release process. 3. **Reduce installation risk** - Avoid global installation by default. - Run the CLI in a sandbox, container, or dedicated least-privileged account. - Disable npm lifecycle scripts where compatible with the package. - Do not run npm, `npx`, or the CLI with administrator or root privileges. 4. **Restrict credential exposure** - Use narrowly scoped, short-lived API credentials where supported. - Protect the local configuration file with owner-only permissions. - Rotate the API key promptly if package compromise is suspected. - Avoid exposing unrelated secrets through the CLI process environment. 5. **Control file and network access** - Require explicit user confirmation before uploading each local file. - Limit filesystem access to the files deliberately selected for generation. - Restrict outbound traffic to the documented dLazy endpoints when operationally feasible. 6. **Vendor or bundle reviewed code** - For stronger assurance, include a reviewed implementation in the Skill artifact or distribute a verified standalone binary with a pinned cryptographic digest rather than retrieving executable code at invocation time. ]]>