T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Execution of an External npm Package Outside the Audited Codebase<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5`, `SKILL.md:61-67`, and `SKILL.md:80-81`. The same installation configuration and execution behavior are mirrored in `SKILL-cn.md:5`, `SKILL-cn.md:61-67`, and `SKILL-cn.md:80-81`. **Vulnerability Type**: Third-party dependency and supply-chain risk **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:5`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy vidu-audio-clone -h for help."}} ``` From `SKILL.md:61-67`: ```markdown You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` From `SKILL.md:80-81`: ```markdown **CRITICAL INSTRUCTION FOR AGENT**: Run the `dlazy vidu-audio-clone` command to get results. ``` ### Technical Analysis The Skill directs the agent to install or execute `@dlazy/cli@1.2.3` from the npm registry. However, the audited project contains only two Markdown files and does not include the CLI implementation, a package lockfile, a cryptographic integrity digest, a signed artifact, or vendored source code. Consequently, the behavior of the executable dependency cannot be verified from this project. Pinning the dependency to version `1.2.3` reduces unintentional version drift, but it does not independently authenticate the retrieved package or protect against a compromis ...[truncated 2481 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor the exact CLI source or executable artifact into a reviewable, version-controlled release so the code being executed can be audited together with the Skill. 2. Publish and verify a cryptographic integrity digest or signed provenance record for the npm package and all transitive dependencies. 3. Use a lockfile with integrity fields where installation architecture permits it, rather than relying only on a package version. 4. Review npm lifecycle scripts and disable them with `--ignore-scripts` when they are not required. If lifecycle scripts are necessary, document and audit each one. 5. Execute the CLI in a sandbox or container with: - Access only to explicitly selected input files. - A read-only filesystem wherever possible. - No access to unrelated home-directory files. - Restricted outbound network access limited to documented service endpoints. - No administrative or root privileges. 6. Require explicit user approval before installing the package, transmitting local media, or executing an unaudited external binary. 7. Store API credentials using an operating-system credential manager where possible, and provide only short-lived, narrowly scoped credentials to the isolated process. 8. Independently audit the exact `@dlazy/cli@1.2.3` package artifact and its transitive dependencies before treating the Skill as trusted. 9. Keep the English and Chinese Skill definitions synchronized so both enforce the same dependency verification and sandboxing requirements. ]]>