T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Third-Party npm Package Is Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5, 67-73` **Mirrored Location**: `SKILL-cn.md:5, 66-72` **Vulnerability Type**: Unverified third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When this skill is called, use dlazy <subcommand>."}} ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ```text Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` ### Technical Analysis The Skill delegates its executable behavior to the externally distributed npm package `@dlazy/cli@1.2.3`. Pinning the package version reduces unintended version drift, but it does not independently verify the integrity or provenance of the downloaded artifact. The project does not contain the CLI implementation, a package lockfile, a cryptographic checksum, a verified signature, or a vendored copy of the reviewed dependency. Consequently, the behavior that handles credentials, reads user-supplied media, communicates with remote APIs, and processes generated output cannot be validated from the audited project itself. Both installation methods introduce supply-chain exposure: - `npx @dlazy/cli@1.2.3` downloads and executes code obtained through the npm distribution channel. - `npm install -g @dlazy/cli@1.2.3` installs the package persistently and may execute npm lifecycle scripts during installation. - A version pin does not protect against a pa ...[truncated 2089 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Add cryptographic integrity verification** - Publish an official SHA-256 digest or verifiable signature for the exact npm artifact. - Verify the downloaded package against that value before installation or execution. - Record npm integrity metadata in a committed lockfile where the hosting framework supports it. 2. **Vendor and audit the executable implementation** - Include the exact reviewed CLI source or packaged artifact in the Skill release. - Ensure the shipped artifact is reproducibly built from the referenced source repository. - Document the source commit corresponding to version `1.2.3`. 3. **Avoid global installation by default** - Prefer an isolated, application-local dependency directory or a sandboxed runtime. - Do not grant administrative privileges to npm. - Remove the global package after use if persistent installation is unnecessary. 4. **Restrict npm lifecycle behavior** - Use `--ignore-scripts` when lifecycle scripts are not required. - If scripts are required, document and audit each installation script before execution. 5. **Apply runtime isolation** - Run the CLI with access limited to the media files explicitly selected by the user. - Restrict filesystem access to the minimum necessary directories. - Limit outbound connections to documented domains and verify TLS certificates. - Keep credentials out of broadly inherited environments where practical. 6. **Strengthen provenance documentation** - Identify the exact source commit, build process, package digest, and signing identity. - Verify that the npm artifact matches the referenced GitHub source. - Establish a dependency-update review process before changing the pinned version. ]]>