T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Execution of an Unreviewed Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5, 50-58`; mirrored in `SKILL-cn.md:5, 50-58` **Vulnerability Type**: Third-party supply-chain exposure through package installation and execution **Risk Level**: Medium ### Vulnerable Code Snippet From `SKILL.md:5`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy pixverse-c1 -h for help."}} ``` From `SKILL.md:50-58`: ```markdown You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` Equivalent installation instructions appear in `SKILL-cn.md`. ### Technical Analysis The Skill requires downloading and executing `@dlazy/cli@1.2.3` from the npm ecosystem, but the package source and dependency tree are not included in the audited artifact. Consequently, the actual executable behavior cannot be verified from the two submitted documentation files. Pinning the package version reduces the risk of silently receiving a later release, but it does not establish the integrity or safety of the pinned artifact. npm installation may execute package lifecycle scripts, and the installed CLI may execute arbitrary JavaScript with the permissions of the invoking user. Its transitive dependencies also remain outside the reviewed project. The global installation form creates persistent changes in the user's n ...[truncated 2197 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Vendor the reviewed implementation** - Include the CLI source or a minimal purpose-built client in the Skill artifact. - Audit all executable code and transitive dependencies before distribution. 2. **Verify artifact integrity** - Record and verify the expected package tarball digest before execution. - Use npm lockfiles with integrity fields where applicable. - Adopt signed releases and verifiable package provenance. - Document the exact commit, package digest, and build process corresponding to version `1.2.3`. 3. **Reduce installation risk** - Prefer a sandboxed, non-global invocation over `npm install -g`. - Run the CLI under a dedicated low-privilege account or isolated container. - Disable npm lifecycle scripts where compatible, for example through an appropriately tested `--ignore-scripts` installation policy. - Use a controlled package registry or approved internal mirror. 4. **Minimize credential and filesystem exposure** - Provide the API key only to the specific process that requires it. - Restrict the CLI's filesystem access to explicitly selected input and output paths. - Prevent access to unrelated home-directory files and environment variables where sandboxing is available. 5. **Constrain network access** - Allow outbound access only to the documented endpoints required for operation, such as `api.dlazy.com` and `files.dlazy.com`. - Monitor unexpected DNS queries or connections to undeclared destinations. 6. **Avoid automatic installation** - Require explicit user approval before downloading or globally installing the package. - Clearly distinguish package installation from normal Skill invocation. - Display the package source, version, and verified digest before execution. 7. **Perform recurring supply-chain review** - Scan the pinned package and dependency tree for known vulnerabilities. - Review package ownership and release provenance. - ...[truncated 111 chars]