T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Third-Party CLI Is Downloaded and Executed Without Artifact Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:4`, `SKILL.md:61-67`; mirrored in `SKILL-cn.md:4`, `SKILL-cn.md:61-67` **Vulnerability Type**: Unverified third-party dependency execution **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:4`: ```yaml metadata: {"clawdbot":{"emoji":"📱","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When this skill is called, run 'dlazy chat --skill short-video --prompt ...' for a new task, or 'dlazy chat --project <id> --prompt ...' to continue (discover ids via 'dlazy projects list'). Never pass both --skill and --project."}} ``` From `SKILL.md:61-67`: ```markdown You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` Equivalent installation instructions appear in the Chinese-language mirror at `SKILL-cn.md:4` and `SKILL-cn.md:61-67`. ### Technical Analysis The Skill delegates its operation to `@dlazy/cli@1.2.3`, which is downloaded from the npm ecosystem and executed locally through either `npm install -g` or `npx`. The implementation of this package is not included in the audited project, so its lifecycle scripts, runtime behavior, credential handling, file access, and network activity cannot be verified from the supplied artifact. Pinning the dependency to version `1.2.3` reduces unintended version drift, but no expected package digest, lockfile integrity entry, cryptog ...[truncated 1995 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor a reviewed copy of the required CLI source or distribute a reviewed, immutable build artifact with the Skill. 2. Publish and verify an expected cryptographic digest for the exact package tarball before installation or execution. 3. Add a lockfile containing npm integrity metadata where the execution environment supports locked dependency installation. 4. Use npm package provenance or signature verification and document the expected publisher identity. 5. Avoid global installation where possible and do not execute installation commands with administrator or root privileges. 6. Disable npm lifecycle scripts where operationally feasible, for example by using an installation workflow with `--ignore-scripts`, and explicitly run only reviewed entry points. 7. Execute the CLI in a sandbox with filesystem and network access limited to the files and endpoints required for short-video generation. 8. Restrict access to `~/.dlazy/config.json`, rotate the API key if dependency compromise is suspected, and prefer short-lived or narrowly scoped credentials where supported. 9. Document the approved npm registry and reject unexpected local registry overrides. 10. Re-audit the exact CLI artifact whenever its pinned version or verified digest changes. ]]>