T08 · Insecure Dependencies
Warning
- Location
- scripts/install_pack.sh:9
- Finding
- Unpinned Non-Interactive Installation of Third-Party Skills## Vulnerability Details **File Location**: `scripts/install_pack.sh`, lines 9–35 and 47–50 **Vulnerability Type**: Third-party supply-chain risk caused by mutable, unverified dependencies **Risk Level**: Medium ### Vulnerable Code ```bash core=( aoi-openclaw-security-toolkit-core aoi-prompt-injection-sentinel aoi-sandbox-shield-lite aoi-cron-ops-lite token-guard ) minimal=( aoi-openclaw-security-toolkit-core aoi-cron-ops-lite ) full=( aoi-openclaw-security-toolkit-core aoi-prompt-injection-sentinel aoi-sandbox-shield-lite aoi-cron-ops-lite token-guard publish-guard aoi-triple-memory-lite aoi-council aoi-hackathon-scout-lite aoi-squad-orchestrator-lite aoineco-squad-dispatch aoineco-ledger aoi-demo-clip-maker ) for s in "${skills[@]}"; do echo "- clawhub install $s" >&2 clawhub install "$s" --no-input done ``` ### Technical Analysis The script installs external ClawHub skills using package names alone. It does not pin immutable versions or content digests, verify package signatures or publisher identity, or compare downloaded content against an approved lockfile. The `--no-input` option also suppresses interactive confirmation during installation. Consequently, the reviewed installer does not uniquely identify the content that will be installed. A package can change after this project has been audited while retaining the same name. Although the documentation attributes the bundle to a particular publisher, the installation command does not enforce that attribution. The issue applies to all modes: `minimal` installs two external skills, `core` installs five, and `full` installs thirteen. ### Attack Path 1. An attacker compromises a listed package or its publisher account, takes control of a transferred package name, or otherwise causes malicious content to be published under one of the listed names. 2. A user invokes `script ...[truncated 1159 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every skill to an immutable version and, where supported, a cryptographic content digest. 2. Maintain a reviewed lockfile mapping each skill name to its expected publisher, version, and digest. 3. Verify registry signatures and publisher identity before installation, failing closed when verification is unavailable or unsuccessful. 4. Remove `--no-input` for untrusted or first-time installations, or add an explicit confirmation step that displays the exact resolved versions and publishers. 5. Download dependencies into a staging area and review or scan their instructions and executable files before making them available to the agent. 6. Install skills with least privilege and isolate their execution from credentials, sensitive files, network access, and privileged tools unless explicitly required. 7. Use a trusted internal mirror or approved allowlist to prevent package substitution and unexpected upstream changes. 8. Add automated integrity checks in CI and before runtime installation so that any deviation from the reviewed dependency set aborts the process.