T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unaudited External npm Package Is Installed and Executed Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:5, 54-60`; mirrored in `SKILL-cn.md:5, 53-60` **Vulnerability Type**: Third-party supply-chain exposure **Risk Level**: Medium **Relevant code from `SKILL.md`:** ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy seedance-2.0 -h for help."}} ``` ```markdown You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` **Equivalent code from `SKILL-cn.md`:** ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, the agent may use dlazy seedance-2.0 -h for help."}} ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` The global installation alternative is: ```bash npm install -g @dlazy/cli@1.2.3 ``` ### Technical Analysis The skill delegates its operation to the external npm package `@dlazy/cli`. Although version `1.2.3` is pin ...[truncated 2826 chars]
- Remediation
- ## Remediation Suggestions 1. Vendor the required CLI implementation into a reviewable, version-controlled component or include its complete audited source in the skill distribution. 2. Verify downloaded artifacts against an approved cryptographic integrity digest or signed provenance before execution. Pin both the direct package and its complete transitive dependency graph. 3. Include a lockfile generated from the reviewed dependency set and enforce immutable or reproducible installation in deployment. 4. Prefer a package manager mode that refuses dependency or lockfile changes and validates registry integrity metadata. 5. Disable npm lifecycle scripts where operationally possible, for example by using an installation policy equivalent to `--ignore-scripts`, after confirming that the reviewed CLI does not legitimately require them. 6. Avoid global installation. Execute the reviewed artifact from an isolated, non-privileged environment with narrowly scoped filesystem and network access. 7. Restrict the process to only user-approved media paths and the required endpoints. Do not expose unrelated home-directory content, SSH material, or broad environment variables. 8. Store the API key using an operating-system credential manager where possible, use a narrowly scoped key, and support prompt rotation and revocation. 9. Add automated software-composition analysis, registry provenance verification, and periodic review of the pinned package and every transitive dependency. 10. Document the exact artifact digest and reviewed source revision rather than relying only on the mutable association between an npm version and a GitHub repository.