T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Execution of Third-Party npm CLI Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5, 61-64`; equivalent instructions in `SKILL-cn.md:5, 61-64` **Vulnerability Type**: Third-party supply-chain dependency executed without package integrity verification **Risk Level**: Medium ### Vulnerable Code From `SKILL.md`: ```yaml metadata: {"clawdbot":{"emoji":"🛒","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When this skill is called, run 'dlazy chat --skill product-to-ecommerce-video --prompt ...' for a new task, or 'dlazy chat --project <id> --prompt ...' to continue (discover ids via 'dlazy projects list'). Never pass both --skill and --project."}} ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ```bash npm install -g @dlazy/cli@1.2.3 ``` Equivalent instructions from `SKILL-cn.md`: ```yaml metadata: {"clawdbot":{"emoji":"🛒","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"当调用此技能时，新任务运行 'dlazy chat --skill product-to-ecommerce-video --prompt ...'，继续已有项目用 'dlazy chat --project <id> --prompt ...'（用 'dlazy projects list' 查 id）；不要同时传 --skill 和 --project。"}} ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ```bash npm install -g @dlazy/cli@1.2.3 ``` ### Technical Analysis The skill instructs the agent or user to download and execute `@dlazy/cli` directly ...[truncated 2894 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Generate and maintain an approved lockfile containing the exact npm integrity digest for `@dlazy/cli@1.2.3`. 2. Verify the downloaded package against a trusted SHA-512 digest or signed release manifest before installation or execution. 3. Audit and vendor the exact reviewed CLI artifact when feasible instead of dynamically retrieving it through `npx`. 4. Establish reproducible-build or provenance verification, such as npm provenance attestations and a documented mapping between the reviewed source commit and published package. 5. Disable or strictly control npm lifecycle scripts where they are unnecessary. 6. Prefer an isolated, non-privileged execution environment with access only to explicitly attached files and required network destinations. 7. Do not run the installation with `sudo`, as an administrator, or under an account with broader permissions than the task requires. 8. Restrict outbound network access to the documented endpoints and monitor unexpected connections. 9. Protect `~/.dlazy/config.json` with owner-only permissions, use short-lived or narrowly scoped credentials where supported, and rotate the API key after any suspected package compromise. 10. Document a package-verification procedure in both language variants so users and agents do not execute an artifact based solely on its package name and version. ]]>