T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:25
- Finding
- Unpinned and Unaudited External Implementation## Vulnerability Details **File Location**: `SKILL.md:25-29` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium **Complete Code Snippet**: ```markdown **Required:** `plugineval-core` ```bash clawhub install plugineval-core ``` ``` Related unsafe source instructions appear in `EXTERNAL.md:15-19`: ```markdown If running standalone: 1. Clone: https://github.com/Donmeusi/openclaw-config 2. Copy scripts from `scripts/` to your PATH 3. Ensure Python 3.9+ and dependencies are installed ``` ### Technical Analysis The skill does not bundle its substantive evaluation implementation. Instead, it instructs users to install `plugineval-core` without a pinned version and, alternatively, clone a mutable Git repository and copy scripts into `PATH`. No immutable commit identifier, package lock, checksum, signature, or integrity-verification procedure is provided. This creates a supply-chain trust boundary that cannot be audited from the submitted artifact. The downloaded package or repository contents may change after this skill has been reviewed. Copying externally obtained scripts into `PATH` additionally makes them available as trusted local commands. ### Attack Path 1. An attacker compromises the referenced package, its distribution account, or the remote repository, or introduces a malicious future update. 2. A user follows the documented instructions and installs the unpinned package or clones the repository's current state. 3. The user copies the externally sourced scripts into `PATH` or invokes the installed evaluator. 4. The attacker-controlled implementation executes with the privileges of the invoking user. 5. It can inspect supplied skill content, manipulate evaluation results, access user-readable local resources, or perform other commands permitted to that user. ### Impact Assessment Successful exploitation permits arbitrary behavior within the invoking user's privilege ...[truncated 449 chars]
- Remediation
- ## Remediation Suggestions 1. Bundle the required implementation in the audited artifact where practical. 2. Pin `plugineval-core` to an exact, reviewed version rather than installing the latest available release. 3. Pin repository installation instructions to a specific immutable commit hash and verified release tag. 4. Publish and verify cryptographic checksums or signatures before executing downloaded files. 5. Use a lockfile or equivalent dependency manifest to pin all transitive dependencies. 6. Install scripts into an isolated, skill-specific environment rather than copying them into a general-purpose `PATH`. 7. Apply least privilege and sandbox the evaluator, restricting filesystem and network access to what the evaluation requires. 8. Reconcile the conflicting version declarations in `SKILL.md`, `EXTERNAL.md`, and `_meta.json`, and ensure all documented script paths correspond to files actually shipped or immutably referenced.