T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Third-Party CLI Is Installed and Executed Without Independent Integrity Verification## Vulnerability Details **File Location**: `SKILL.md`, lines 4 and 52–58; mirrored in `SKILL-cn.md`, lines 4 and 52–58 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy seedance-2.5 -h for help."}} ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ```bash npm install -g @dlazy/cli@1.2.3 ``` ### Technical Analysis The Skill directs the host to install or execute the externally hosted npm package `@dlazy/cli`. Pinning the dependency to version `1.2.3` limits version drift, but the reviewed project does not include the dependency source, a trusted package digest, a lockfile with integrity metadata, or an independent signature-verification mechanism. The `npx` path can retrieve and execute the package directly from the configured npm registry. The global installation path additionally persists the executable outside the Skill directory. Because npm packages can run JavaScript and lifecycle hooks with the invoking user's permissions, compromise of the published package, its transitive dependencies, the publisher account, or the package-distribution channel could result in arbitrary local code execution. This audit found no evidence that `@dlazy/cli@1.2.3` is currently malicious. The issue is the trust placed in remotely distributed executable code without an integrity control represented in the audited project. ### Attack Path 1. An attacker compromises the npm publisher account, pac ...[truncated 1485 chars]
- Remediation
- ## Remediation Suggestions 1. Vendor and audit the required CLI source or distribute a reviewed binary from a controlled release channel. 2. Verify the package artifact against a trusted cryptographic digest or signature before execution. 3. Maintain a lockfile containing integrity metadata for the package and all transitive dependencies. 4. Avoid global installation where possible; run the dependency in an isolated, least-privileged environment. 5. Disable npm lifecycle scripts when they are unnecessary, for example by using `--ignore-scripts`, after confirming that this does not break legitimate functionality. 6. Restrict filesystem and network access through sandboxing or containerization. Expose only the specific media files required for the requested generation. 7. Use a short-lived, narrowly scoped API credential where supported and rotate it if dependency compromise is suspected. 8. Document a reproducible verification process tying the reviewed source revision to the exact npm artifact. 9. Apply the same hardened installation guidance to both `SKILL.md` and `SKILL-cn.md`.