T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Execution of an Unreviewed Third-Party npm Package Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:4,64-70` and mirrored in `SKILL-cn.md:4,64-70` **Vulnerability Type**: Unverified third-party package installation and execution **Risk Level**: Medium ### Vulnerable Code From `SKILL.md`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy seedance-2.0-fast -h for help."}} ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ```text npm install -g @dlazy/cli@1.2.3 ``` The same installation and execution instructions appear in `SKILL-cn.md`. ### Technical Analysis The Skill delegates all executable behavior to the external npm package `@dlazy/cli@1.2.3`. The package implementation and its transitive dependencies are not included in the audited project, so their behavior cannot be verified from this artifact. Both documented installation methods can execute externally supplied code: - `npm install -g` can run npm lifecycle scripts and installs the package globally. - `npx` retrieves and executes the package from the configured npm registry. - Transitive dependencies may introduce additional executable code. - No package integrity digest, signature verification, vendored dependency set, or reproducible-build evidence is provided. Pinning the package to version `1.2.3` reduces unintended version drift, but it does not independently verify the integrity or provenance of the registry artifact. This creates a supply-chain trust boundary: compromise of the publisher account, package distribution infrastructure, or a transitive dependency could cause code to exec ...[truncated 1856 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor the executable CLI implementation and all required dependencies into a reviewable, version-controlled source tree. 2. Commit and enforce a lockfile containing registry-resolved integrity hashes for direct and transitive dependencies. 3. Verify package provenance using signed releases, npm provenance attestations, and reproducible-build checks before execution. 4. Prefer installation from a trusted internal registry or verified artifact repository rather than resolving executable code dynamically. 5. Disable npm lifecycle scripts where they are unnecessary: ```bash npm install --ignore-scripts ``` Confirm first that the package does not legitimately require installation scripts. 6. Avoid global installation. Execute the CLI in an isolated environment or container with: - A non-privileged user. - A read-only filesystem where practical. - Access only to explicitly selected media files. - Restricted environment variables. - Network access limited to documented API endpoints. 7. Provide and verify a cryptographic digest for the exact package archive expected by the Skill. 8. Audit the package's transitive dependency graph and continuously monitor it for compromised, deprecated, or newly introduced packages. 9. Keep API credentials scoped to minimum privileges, store them using an operating-system credential manager where possible, and support immediate rotation following suspected compromise. 10. Update both `SKILL.md` and `SKILL-cn.md` so their installation guidance and security controls remain consistent. ]]>