T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unverified External npm Package Is Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md:5`, `SKILL-cn.md:5` **Vulnerability Type**: Third-party supply-chain exposure through automatic npm package installation and execution **Risk Level**: Medium ### Vulnerable Code `SKILL.md:5`: ```json metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy superres -h for help."}} ``` `SKILL-cn.md:5`: ```json metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"当调用此技能时，可以使用 dlazy superres -h 查看帮助信息。"}} ``` ### Technical Analysis The Skill contains no local executable implementation. Instead, it delegates all substantive behavior to the external npm package `@dlazy/cli@1.2.3`. Both supported installation paths cause code obtained from the npm registry to execute on the local system: - `npm install -g` may execute package lifecycle scripts and installs a persistent executable into the user's global npm environment. - `npx` retrieves and executes package code on demand. Pinning the dependency to version `1.2.3` limits unexpected upgrades, but it does not cryptographically establish that the downloaded artifact is the exact artifact reviewed by the Sk ...[truncated 2461 chars]
- Remediation
- ## Remediation Suggestions 1. **Verify artifact integrity** - Publish and enforce a trusted integrity digest for the exact npm package archive. - Verify npm provenance or cryptographic signatures before execution. - Document how the npm artifact maps reproducibly to a reviewed source commit. 2. **Vendor and audit executable code** - Include the minimal required CLI implementation in the reviewed project, or maintain a separately audited and locked dependency bundle. - Audit direct and transitive dependencies for the pinned release. 3. **Restrict npm lifecycle behavior** - Install with lifecycle scripts disabled where compatible, such as by using `npm install --ignore-scripts`. - Explicitly inspect any required lifecycle scripts before permitting them. - Use a lockfile and integrity-checked installation process rather than relying only on a package name and version. 4. **Avoid global installation** - Prefer an isolated, temporary environment over `npm install -g`. - Do not allow the package to alter globally available tools or shared package directories. 5. **Apply runtime isolation** - Run the CLI under a dedicated low-privilege account or sandbox. - Restrict filesystem access to the specific input and output files required for the operation. - Restrict outbound network access to the documented service endpoints where practical. - Do not expose unrelated environment variables or credentials to the CLI process. 6. **Protect the API key** - Confirm that `~/.dlazy/config.json` is created with user-only permissions. - Use a narrowly scoped, revocable API key. - Rotate the key immediately if dependency compromise is suspected. - Avoid passing the key through command-line arguments, logs, or other observable channels. 7. **Continuously monitor the dependency** - Track security advisories and ownership changes for `@dlazy/cli` and its dependency tree. - ...[truncated 65 chars]