T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unverified Third-Party CLI Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5, 65-69`; equivalent translated instructions in `SKILL-cn.md:5, 61-65` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:5`: ```yaml metadata: {"clawdbot":{"emoji":"📄","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When this skill is called, run 'dlazy chat --skill file-to-video --prompt ...' for a new task, or 'dlazy chat --project <id> --prompt ...' to continue (discover ids via 'dlazy projects list'). Never pass both --skill and --project."}} ``` From `SKILL.md:65-69`: ```markdown You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` ``` The translated file contains the same behavior at `SKILL-cn.md:5, 61-65`: ```yaml metadata: {"clawdbot":{"emoji":"📄","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"当调用此技能时，新任务运行 'dlazy chat --skill file-to-video --prompt ...'，继续已有项目用 'dlazy chat --project <id> --prompt ...'（用 'dlazy projects list' 查 id）；不要同时传 --skill 和 --project。"}} ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ### Technical Analysis The Skill directs the agent or user to install or execute `@dlazy/cli@1.2.3` from the npm registry ...[truncated 2766 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bundle the required implementation with the Skill so that its executable code can be reviewed alongside the Skill documentation. 2. If external package retrieval remains necessary, publish and verify a cryptographic integrity value for the exact npm artifact before execution. 3. Provide a lockfile or equivalent manifest that pins the complete transitive dependency graph rather than only the top-level package version. 4. Establish provenance between the npm artifact and a specific reviewed source revision through signed releases, npm provenance attestations, and reproducible builds. 5. Prefer ephemeral, least-privilege execution in a sandbox or container instead of global installation. 6. Disable npm lifecycle scripts where operationally possible, for example by using an installation process that applies `--ignore-scripts` after verifying that the package does not legitimately require them. 7. Restrict filesystem and network access to the minimum required destinations and documents. 8. Keep API credentials scoped, revocable, and short-lived where possible, and ensure that credential files remain readable only by the owning user. 9. Document a package-verification procedure that users or agents must complete before first execution and after every dependency update. 10. Independently audit the exact published package and its complete dependency graph before treating it as trusted. ]]>