T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Execution of an Unaudited Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5,57`; mirrored in `SKILL-cn.md:5,57` **Vulnerability Type**: Third-party dependency and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code `SKILL.md:5`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy search_video -h for help."}} ``` `SKILL.md:54-58`: ```bash You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` ``` Equivalent installation and execution instructions appear in `SKILL-cn.md:5,54-58`. ### Technical Analysis The Skill directs the host to install or execute `@dlazy/cli@1.2.3` from the npm registry. The implementation of that dependency is not present in the audited project, so its package contents, transitive dependencies, and lifecycle scripts could not be verified as part of this audit. Pinning the dependency to version `1.2.3` reduces unintended version drift, but it does not provide cryptographic verification or protect against compromise of the selected package version, its transitive dependency graph, the registry account, or the distribution infrastructure. The global installation form can also modify the user's executable environment. The `npx` form retrieves and executes package code on demand. This finding represents a supply-chain trust boundary rather than evidence that the named package is currently malicious. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution path, selected package artifact, or a transi ...[truncated 1425 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor or otherwise include the required implementation in a reviewable release artifact so its behavior can be audited alongside the Skill. 2. Verify downloaded package artifacts using trusted cryptographic integrity metadata or an independently maintained allowlist of approved hashes. 3. Maintain a lockfile covering the complete transitive dependency graph and review changes before updating it. 4. Generate and review a software bill of materials for the CLI and its transitive dependencies. 5. Disable npm lifecycle scripts where compatible, such as by using `--ignore-scripts`, and separately execute only explicitly reviewed setup operations. 6. Prefer an isolated, non-global installation rather than `npm install -g`, and run the CLI in a sandbox or container with minimal filesystem and network permissions. 7. Restrict the process from accessing unrelated credentials, sensitive directories, and environment variables. 8. Use registry provenance, package-signing, and publisher identity checks where supported. 9. Continuously scan the pinned package and its transitive dependencies for known vulnerabilities and publisher or integrity changes. 10. Document the external execution boundary clearly and require explicit user approval before package installation or first execution. ]]>