T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unverified Third-Party CLI Is Downloaded and Executed Locally<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5,55-61`; equivalent localized instructions at `SKILL-cn.md:5,55-61` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:5`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy vectorize -h for help."}} ``` `SKILL.md:55-61`: ```bash npx @dlazy/cli@1.2.3 <command> ``` ```bash npm install -g @dlazy/cli@1.2.3 ``` Equivalent commands appear in `SKILL-cn.md:5,55-61`. ### Technical Analysis The project contains only Skill documentation and does not include the source code of the CLI it instructs the agent to execute. Both supported installation paths retrieve `@dlazy/cli@1.2.3` and its transitive dependencies from the npm ecosystem, after which package lifecycle scripts or CLI runtime code can execute with the permissions of the invoking user. Pinning the package to version `1.2.3` limits unreviewed version drift, but the Skill does not declare a package integrity digest, signature-verification mechanism, locked transitive dependency graph, or reproducible artifact. Consequently, the actual executable artifact cannot be verified solely from the audited project. A compromised npm publication account, package artifact, or transitive dependency could therefore introduce code that is not visible in these files. The global installation alternative increases exposure by persistently installing the executable into the user's environment. The reviewed files do not establish that the named package is currently ma ...[truncated 1508 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor the reviewed CLI source or distribute a reproducible, audited artifact with the Skill. 2. Publish and verify a cryptographic integrity digest or trusted signature before executing the package. 3. Lock and audit the complete transitive dependency graph rather than relying only on a top-level package version. 4. Use npm lockfiles and integrity metadata where installation architecture permits. 5. Prefer a project-local, sandboxed installation over `npm install -g` to reduce persistence and system-wide exposure. 6. Disable npm lifecycle scripts with `--ignore-scripts` when the package can operate without them. 7. Run the CLI under a dedicated, least-privileged account or restricted container with access only to the required input and output files. 8. Prevent the CLI process from reading unrelated credentials and files; provide the API key only for the duration of the invocation. 9. Document the exact package artifact, dependency versions, expected network endpoints, and reviewed cryptographic hashes. 10. Periodically re-audit the pinned package and all transitive dependencies for account compromise, malicious publication, and known vulnerabilities. ]]>