T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:67
- Finding
- Third-Party npm Package Executed Without Artifact Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:6`, `SKILL.md:67-73`; mirrored in `SKILL-cn.md:6`, `SKILL-cn.md:66-72` **Vulnerability Type**: Third-party supply-chain dependency executed without local auditability or cryptographic integrity verification **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy seedream-4.5 -h for help."}} ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ```text npm install -g @dlazy/cli@1.2.3 ``` ### Technical Analysis The Skill instructs the environment to retrieve and execute `@dlazy/cli@1.2.3` directly from the npm package registry. Pinning the package version limits unintended version drift, but it does not cryptographically establish that the downloaded package is the artifact that was reviewed or expected. The external package is not included in the audited project, so its executable code and npm lifecycle scripts cannot be evaluated from this artifact. The referenced GitHub repository also does not, by itself, prove that the source repository and the published npm archive are identical. Both supported installation mechanisms create supply-chain exposure: - `npx` downloads and executes the npm-hosted package on demand. - `npm install -g` may run package lifecycle scripts and persist a globally available executable. - Neither instruction specifies a trusted package digest, signature, lockfile integrity value, or independent artifact verification process. No evidence in the reviewed files proves that the named package is cur ...[truncated 1634 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Verify the package artifact before execution** - Publish and document a trusted SHA-256 or stronger digest for the exact npm archive. - Download the package without executing it, verify the digest, and only then install or invoke it. - Prefer signed provenance, such as npm provenance attestations backed by a trusted build workflow. 2. **Make builds reproducible and auditable** - Link the exact source commit corresponding to version `1.2.3`. - Publish build instructions and attest that the npm artifact was generated from that commit. - Independently compare the contents of the published npm archive with the expected build output. 3. **Reduce installation-time execution** - Avoid global installation unless it is strictly required. - Where compatible, download with lifecycle scripts disabled using `npm install --ignore-scripts`. - Audit any required lifecycle scripts before allowing them to run. 4. **Constrain execution** - Run the CLI as a non-privileged user in a sandbox or container. - Restrict filesystem access to only the explicitly selected input and output paths. - Restrict outbound network access to the documented endpoints when operationally feasible. - Do not expose unrelated secrets or sensitive environment variables to the CLI process. 5. **Control transitive dependencies** - Maintain and review a lockfile containing integrity values. - Continuously scan direct and transitive dependencies for compromise and known vulnerabilities. - Revoke affected API keys and replace the package immediately if package integrity cannot be established. ]]>