T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Execution of a Third-Party npm Package Without Locally Auditable Implementation or Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5, 53-60`; equivalent installation directives in `SKILL-cn.md:5, 53-60` **Vulnerability Type**: Third-party package and software supply-chain risk **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:5`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy minimax-h3 -h for help."}} ``` From `SKILL.md:53-60`: ```markdown You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` The same package installation and execution mechanisms appear in `SKILL-cn.md:5, 53-60`. ### Technical Analysis The Skill contains no local executable implementation. Instead, it directs the agent to retrieve and execute `@dlazy/cli@1.2.3` from the npm ecosystem through either `npx` or a global npm installation. Pinning the direct package to version `1.2.3` is a useful control against unintended direct-version updates, but it does not independently verify package integrity, provenance, install-time scripts, or the integrity of transitive dependencies. The audited project does not include a lockfile, trusted package hash, signature, vendored source, or locally reviewable implementation that would establish that the downloaded npm artifact matches the referenced repository. Both installation methods may execute package ...[truncated 2226 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor the required CLI implementation into a reviewed source tree or provide a minimal local client whose full behavior can be audited with the Skill. 2. Generate and commit a lockfile that fixes the complete transitive dependency graph, not only the direct package version. 3. Verify the downloaded package using a trusted cryptographic digest, signed provenance, or registry signature before execution. 4. Ensure that the verified npm artifact is reproducibly linked to the referenced source repository and release tag. 5. Disable npm lifecycle scripts where they are unnecessary, for example with `--ignore-scripts`, after confirming that the package functions safely without them. 6. Avoid global installation. Run the CLI inside an isolated environment with a dedicated cache and no write access outside required output directories. 7. Restrict filesystem access to explicitly selected input files and output paths. 8. Expose only the required API credential and environment variables to the subprocess. 9. Apply outbound network controls permitting only the documented service endpoints. 10. Review the package and its complete dependency graph before every approved version change, and automate dependency vulnerability and provenance checks in the release process. ]]>