T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Execution of an Externally Retrieved npm Dependency Without Locally Verifiable Integrity## Vulnerability Details **File Location**: `SKILL.md:5`, `SKILL.md:51-59`; equivalent installation configuration also appears in `SKILL-cn.md:5` and `SKILL-cn.md:51-59` **Vulnerability Type**: Third-party dependency and software supply-chain exposure **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:5`: ```yaml metadata: {"clawdbot":{"emoji":"📄","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When this skill is called, run 'dlazy chat --skill file-to-video --prompt ...' for a new task, or 'dlazy chat --project <id> --prompt ...' to continue (discover ids via 'dlazy projects list'). Never pass both --skill and --project."}} ``` From `SKILL.md:51-59`: ```markdown You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` ### Technical Analysis The skill delegates its substantive behavior to the external `@dlazy/cli` npm package. Although the dependency is pinned to version `1.2.3`, the audited project does not contain the package source, a lockfile, a cryptographic integrity value, a signed artifact, or a vendored copy that would permit verification of the code executed at runtime. Both supported installation paths execute code obtained outside the audited artifact: - `npx @dlazy/cli@1.2.3` can download and immediately execute the npm package. - `npm install -g @dlazy/cli@1 ...[truncated 2482 chars]
- Remediation
- ## Remediation Suggestions 1. Vendor the exact reviewed CLI implementation or distribute it as an immutable, internally controlled artifact. 2. Record and verify the package archive's cryptographic integrity before execution rather than relying only on a semantic version. 3. Enable npm provenance or signature verification and document the expected publisher identity and verification procedure. 4. Audit and lock the complete transitive dependency graph using a committed lockfile where applicable. 5. Prefer ephemeral, isolated execution over global installation. Run the CLI in a container or sandbox with access limited to the explicitly selected input files. 6. Restrict outbound network access to the documented service endpoints where operationally feasible. 7. Provide credentials to the process with the narrowest possible scope, rotate them regularly, and avoid exposing unrelated environment variables. 8. Add an explicit confirmation step before uploading local files, clearly identifying the selected files and the external destinations. 9. Continuously scan the pinned package and its dependencies for published vulnerabilities, ownership changes, and unexpected artifact changes.