T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Execution of an External npm Package Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:5`, `SKILL.md:61-65`; equivalent installation instructions also appear in `SKILL-cn.md:5`, `SKILL-cn.md:61-65` **Vulnerability Type**: Third-party dependency execution without cryptographic integrity verification **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"🌐","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When this skill is called, run 'dlazy chat --skill website-to-video --prompt ...' for a new task, or 'dlazy chat --project <id> --prompt ...' to continue (discover ids via 'dlazy projects list'). Never pass both --skill and --project."}} ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ```bash npm install -g @dlazy/cli@1.2.3 ``` ### Technical Analysis The Skill directs the agent or user to install or execute the externally hosted npm package `@dlazy/cli@1.2.3`. Pinning the version limits unexpected upgrades, but it does not cryptographically bind the Skill to a reviewed package artifact. The project contains no bundled CLI source, lockfile, integrity digest, signature, or vendored dependency tree that would permit verification of the code ultimately executed. An `npx` invocation may download and execute package code with the permissions of the invoking user. npm installation can also execute package lifecycle scripts. The global installation alternative persists the executable outside the Skill directory and makes it available to later sessions. This creates a supply-chain trust boundary: the effective implementation depends on the npm registry package, its transitive dependencies, and ...[truncated 1910 chars]
- Remediation
- ## Remediation Suggestions 1. **Provide artifact integrity verification** - Publish the expected npm integrity digest or signed provenance for the exact package artifact. - Verify the downloaded artifact before executing it. - Use npm registry provenance and signature verification where supported. 2. **Audit and lock the full dependency graph** - Include a lockfile that records exact transitive versions and integrity hashes. - Review the package and all relevant transitive dependencies before release. - Repeat the review whenever any package artifact or dependency changes. 3. **Avoid implicit remote execution** - Prefer a bundled, reviewed implementation when practical. - If `npx` remains necessary, use options that prevent unexpected package resolution and ensure only the verified version is available. - Avoid global installation unless persistence is operationally required. 4. **Restrict lifecycle scripts** - Install with lifecycle scripts disabled when the package does not require them. - If scripts are required, review each script and execute installation inside a restricted environment. 5. **Apply runtime isolation** - Run the CLI in a sandbox or container with minimal filesystem access. - Remove unrelated secrets from the process environment. - Restrict outbound network access to the documented endpoints when feasible. - Mount only files explicitly selected by the user for upload. 6. **Protect credentials** - Ensure `~/.dlazy/config.json` has restrictive user-only permissions. - Use short-lived, narrowly scoped credentials where supported. - Document credential rotation procedures for suspected dependency compromise.