T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:3
- Finding
- Unverified Third-Party CLI Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:3, 60-69` and mirrored instructions in `SKILL-cn.md:3, 60-69` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"🌐","requires":{"bins":["npm","npx","ffmpeg","ffprobe"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]}} ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ```bash npm install -g @dlazy/cli@1.2.3 ``` ### Technical Analysis The Skill directs the agent or user to download and execute the third-party npm package `@dlazy/cli`. Although the dependency is pinned to version `1.2.3`, the Skill does not verify a cryptographic integrity digest, vendor an audited copy, or otherwise bind execution to reviewed package contents. Version pinning prevents ordinary version drift but does not protect against compromise of the npm publisher account, registry infrastructure, or the already-published artifact. npm installation can also execute package lifecycle scripts. The global installation variant increases exposure by persistently adding package-controlled executables to the user's environment. No evidence in the audited files establishes that the referenced package is currently malicious. The finding concerns the unsafe trust and execution model required by the Skill. ### Attack Path 1. An attacker compromises the npm publisher account, package release, or another relevant supply-chain component. 2. The artifact delivered as `@dlazy/cli@1.2.3` is replaced or otherwise made to contain malicious package code or lifecycle scripts. 3. The user or agent follows the Skill instructions and runs either: - `npm inst ...[truncated 1079 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Publish and document the expected cryptographic integrity digest for the exact npm artifact, and verify it before installation or execution. 2. Vendor a reviewed copy of the required implementation where practical, rather than retrieving executable code dynamically. 3. Prefer a lockfile-backed local installation over global installation or ad hoc `npx` execution. 4. Avoid `npm install -g`; execute the package in an isolated environment with access limited to the designated media working directory. 5. Disable npm lifecycle scripts during installation where compatible: ```bash npm install --ignore-scripts --save-exact @dlazy/cli@1.2.3 ``` 6. Audit any required lifecycle scripts separately before enabling them. 7. Run the CLI under a dedicated, unprivileged account or sandbox without access to unrelated files, credentials, SSH keys, or sensitive environment variables. 8. Restrict outbound network access to the documented endpoints only where operationally feasible. 9. Apply the same hardened installation guidance consistently to both `SKILL.md` and `SKILL-cn.md`. ]]>