T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Unverified Third-Party CLI Is Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md:4` and the duplicated configuration in `SKILL-cn.md:4` **Vulnerability Type**: Third-party dependency and software supply-chain exposure **Risk Level**: Medium **Complete Code Snippet**: ```text metadata: {"clawdbot":{"emoji":"🎞️","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When this skill is called, run 'dlazy chat --skill storyboard --prompt ...' for a new task, or 'dlazy chat --project <id> --prompt ...' to continue (discover ids via 'dlazy projects list'). Never pass both --skill and --project."}} ``` The associated installation instructions at `SKILL.md:48-55` and `SKILL-cn.md:48-55` explicitly recommend executing the dependency through `npx` or installing it globally. ### Technical Analysis The Skill delegates its functionality to the externally distributed npm package `@dlazy/cli`. Pinning the dependency to version `1.2.3` limits unexpected version changes, but the project provides neither a lockfile nor an integrity digest that binds installation to a specifically audited package artifact. Both `npx @dlazy/cli@1.2.3` and `npm install -g @dlazy/cli@1.2.3` retrieve package content from the npm distribution channel and execute package-controlled code. npm lifecycle scripts may also execute during installation unless explicitly disabled. Consequently, compromise of the maintainer account, package release, registry delivery path, or another component in the package's dependency tree could result in arbitrary code execution even though the Skill documents themselves contain no embedded malicious code. ...[truncated 1723 chars]
- Remediation
- ## Remediation Suggestions 1. Audit the exact npm package archive and its complete transitive dependency tree before approving it for Agent execution. 2. Record and verify a trusted cryptographic integrity digest for the approved package artifact rather than relying only on a semantic version. 3. Use a lockfile or an equivalent immutable dependency manifest that includes integrity metadata for all transitive dependencies. 4. Prefer an isolated, project-local installation over `npm install -g` to limit persistence and environmental impact. 5. Disable npm lifecycle scripts with `--ignore-scripts` where compatible with the package, or explicitly review every required lifecycle script before allowing execution. 6. Run the CLI in a restricted sandbox with only the network, filesystem, and credential access required for the requested task. 7. Provide the dLazy credential only to the isolated process and prevent access to unrelated environment variables, SSH keys, browser data, and user files. 8. Require explicit user confirmation before uploading local files, particularly when those files may contain confidential or regulated information. 9. Continuously monitor the approved package version, maintainer ownership, release provenance, and dependency advisories for supply-chain changes.