T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:49
- Finding
- Execution of an Unverified Third-Party npm CLI Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 49-55; dependency installation is also declared in line 4 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Complete Code Snippet**: ```markdown You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` The corresponding metadata declaration is: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy veo-3.1 -h for help."}} ``` ### Technical Analysis The Skill instructs the agent to install or execute `@dlazy/cli@1.2.3` directly from the npm registry. Pinning the version limits unintended version drift, but the project does not include the CLI source, a package-lock entry, a cryptographic integrity digest, or another mechanism that independently verifies the package contents. Both `npx` execution and global npm installation can execute package runtime code. Depending on npm configuration and package contents, installation lifecycle scripts may also execute. The external dependency subsequently receives the dLazy API credential, network access, and access to local media files explicitly supplied by the user. Consequently, compromise of the npm publisher, registry artifact, or package release could turn the documented workflow into arbit ...[truncated 1592 chars]
- Remediation
- ## Remediation Suggestions 1. Publish and verify a cryptographic integrity digest for the exact npm artifact, and enforce that digest through a lockfile or controlled installation mechanism. 2. Vendor the reviewed CLI implementation into a trusted distribution channel or provide reproducible-build instructions that allow the npm artifact to be compared with the public source. 3. Use a committed lockfile and trusted internal registry or package proxy with artifact immutability and malware scanning. 4. Disable npm lifecycle scripts where operationally possible, for example by using an installation policy equivalent to `--ignore-scripts`, after confirming that the package does not legitimately require them. 5. Run the CLI in a sandbox or container with access limited to the specific input and output files required for generation. 6. Restrict outbound network access to the documented service endpoints and prevent access to unrelated hosts. 7. Use a narrowly scoped, revocable API key and avoid exposing unrelated environment variables or credentials to the CLI process. 8. Independently review the source and published artifact before approving upgrades, even when versions remain explicitly pinned.