T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:51
- Finding
- Execution of an Externally Retrieved npm Dependency Without Local Verification< - **Maintainer**: dlazyai - **npm package**: `@dlazy/cli` (pinned to `1.2.3` in this skill's install spec) - **Homepage**: [dlazy.com](https://dlazy.com) You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` The equivalent installation and execution workflow is also documented in `SKILL-cn.md:51-65`. ### Technical Analysis The Skill directs the Agent to retrieve and execute `@dlazy/cli@1.2.3` from the npm registry using either `npx` or a global npm installation. Although the dependency is pinned to a specific version and a public source repository is identified, the audited project contains only documentation. It does not include the CLI source, a package lockfile, a cryptographic integrity value, a signed provenance record, or a vendored executable that would allow the executed artifact to be verified locally. Execution through `npx` downloads package content at invocation time. A global npm installation similarly permits package installation and any applicable npm lifecycle behavior under the invoking user's privileges. Pinning a version reduces accidental version drift but does not independently establish that the registry artifact is trustworthy or identical to the referenced repository. The external CLI is also expected to handle an API key, read user-selected local media, communicate with `api.dlazy.com` and `files.dlazy.com`, and optionally write generated output. Because its implementation is absent f ...[truncated 2016 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor the exact reviewed CLI implementation in the Skill package or provide a minimal auditable client for the required API operation. 2. Publish and verify cryptographic integrity information for the npm artifact, such as a trusted lockfile integrity value and signed build provenance. 3. Ensure the npm package is reproducibly built from the referenced source revision and document the exact source commit corresponding to version `1.2.3`. 4. Prefer an isolated, least-privilege runtime rather than a global installation. Avoid running npm or the CLI with administrator or root privileges. 5. Disable npm lifecycle scripts where compatible with the package, for example by using an installation policy that ignores scripts after confirming they are unnecessary. 6. Restrict outbound network access to the documented endpoints, `api.dlazy.com` and `files.dlazy.com`, and reject unexpected destinations. 7. Restrict filesystem access to the dLazy configuration file, explicitly selected input files, and the requested output location. 8. Keep API credentials scoped to the minimum required permissions and support prompt revocation and rotation. 9. Verify the installed package artifact before execution and periodically audit the dependency, its transitive dependencies, publisher ownership, and release process. 10. Correctly disclose that execution relies on externally retrieved code and require user confirmation before installing or invoking it for the first time. ]]>