T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:54
- Finding
- Third-Party CLI Executed Without Artifact Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:5,54-60`; `SKILL-cn.md:5,54-60` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Evidence Both Skill documents declare installation and execution of a registry-delivered npm package: ```json "install":"npm install -g @dlazy/cli@1.2.3", "installAlternative":"npx @dlazy/cli@1.2.3" ``` The English document also instructs users to execute the package directly: ```markdown You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` The Chinese document contains equivalent installation instructions: ```markdown 如果你不希望在系统上长期保留一个全局 CLI，可以按需运行： ```bash npx @dlazy/cli@1.2.3 <command> ``` 如选择全局安装，技能的 `metadata.clawdbot.install` 字段已固定到 `npm install -g @dlazy/cli@1.2.3`。安装前建议先到 GitHub 仓库审阅源码。 ``` ### Technical Analysis The audited project contains only documentation and does not include the source code of `@dlazy/cli`, a lockfile, an integrity digest, a signed release manifest, or a vendored executable artifact. Consequently, the behavior of the executable dependency cannot be validated from the Skill package itself. Pinning the package to version `1.2.3` limits unexpected version upgrades, but it does not cryptographically establish that the downloaded artifact matches an independently reviewed artifact. Running the package through `npx` or installing it globally causes npm registry content to execute with the privileges of the invoking user. Depending on npm configuration and package contents, package lifecycle scripts may also execute during installation. No evidence was found that the named package is currently malicious. The vulnerability is the unsafe ...[truncated 1767 chars]
- Remediation
- ## Remediation Suggestions 1. Vendor the reviewed CLI source or executable artifact with the Skill so the audited implementation is the implementation that runs. 2. Publish cryptographic SHA-256 or stronger digests for release artifacts and verify them before execution. 3. Use signed package provenance or release signatures and enforce signature verification in the installation process. 4. Commit an npm lockfile containing integrity metadata where an npm-based installation remains necessary. 5. Install with lifecycle scripts disabled where compatible, such as `npm install --ignore-scripts`, and explicitly run only reviewed entry points. 6. Prefer an isolated, least-privilege environment over global installation. Restrict filesystem access, environment variables, and outbound network destinations. 7. Do not expose unrelated secrets to the CLI process. Supply the dLazy credential only when required and use a narrowly scoped, revocable API key. 8. Pin both the version and verified artifact digest; version pinning alone is insufficient. 9. Continuously audit the exact published package artifact and its transitive dependencies rather than relying solely on the linked GitHub repository.