T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Execution of an Externally Distributed npm CLI Without Artifact Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5,56-62`; `SKILL-cn.md:5,56-62` **Vulnerability Type**: Third-party supply-chain exposure **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:5`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy viduq2-t2i -h for help."}} ``` `SKILL.md:56-62`: ```markdown You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` `SKILL-cn.md:5`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"当调用此技能时，可以使用 dlazy viduq2-t2i -h 查看帮助信息。"}} ``` `SKILL-cn.md:56-62`: ```markdown 如果你不希望在系统上长期保留一个全局 CLI，可以按需运行： ```bash npx @dlazy/cli@1.2.3 <command> ``` 如选择全局安装，技能的 `metadata.clawdbot.install` 字段已固定到 `npm install -g @dlazy/cli@1.2.3`。安装前建议先到 GitHub 仓库审阅源码。 ``` ### Technical Analysis The Skill instructs the Agent or user to retrieve and execute `@dlazy/cli@1.2.3` from the npm registry, either throug ...[truncated 2738 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor the reviewed CLI implementation or provide a locally auditable release artifact as part of the Skill distribution. 2. Publish a cryptographic digest or signed provenance record for the exact package artifact and verify it before execution. 3. Provide a lockfile or equivalent manifest that pins the full transitive dependency graph rather than only the top-level package version. 4. Use reproducible builds and signed release attestations to demonstrate that the npm artifact corresponds to the reviewed source repository. 5. Prefer a sandboxed, least-privilege invocation over a global installation. Restrict filesystem access to explicitly selected input and output paths. 6. Restrict outbound network access to the documented service endpoints where the execution environment supports network policy enforcement. 7. Disable npm lifecycle scripts during installation where compatible with the package, and separately verify whether the CLI requires them. 8. Avoid exposing the API key through command-line arguments. Store it in a permission-restricted credential store and use a narrowly scoped, revocable key. 9. Document package-verification and incident-response procedures, including API-key rotation and removal of globally installed binaries following a suspected package compromise. ]]>