T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:12
- Finding
- Untrusted and Unpinned Skill Installation Source## Vulnerability Details **File Location**: `SKILL.md`, lines 12–13 **Vulnerability Type**: Supply-chain risk from an unverified and mutable external repository **Risk Level**: Medium **Complete Code Snippet**: ```bash # Clone to your OpenClaw skills directory git clone https://github.com/yourusername/lmstudio-model-switch \ ~/.openclaw/workspace/skills/lmstudio-model-switch ``` ### Technical Analysis The installation instructions clone an external Git repository directly into OpenClaw's trusted skills directory. The repository owner, `yourusername`, is a placeholder and does not correspond to the author identified elsewhere in the document. The command also does not pin a reviewed commit, immutable tag, signed release, or expected content hash. Consequently, the content installed by this command may differ from the audited artifact and may change at any time after review. If the referenced repository is created, transferred, or compromised, its controller could add malicious skill instructions, scripts, or other executable components. This is an insecure supply-chain practice rather than evidence that the currently supplied `SKILL.md` contains an embedded malicious payload. The audited project contains only `SKILL.md`; therefore, the advertised model-switching implementation, configuration editing, backup behavior, and service restart logic could not be independently reviewed. ### Attack Path 1. An attacker obtains control of, compromises, or registers the repository referenced by the placeholder URL. 2. The attacker adds malicious instructions or executable components to the repository. 3. A user follows the documented `git clone` command without verifying the repository identity, commit, signature, or file hashes. 4. The attacker-controlled content is placed directly under `~/.openclaw/workspace/skills/`. 5. OpenClaw subsequently discovers or loads the installed skill. 6. Any malicious behavior would execute o ...[truncated 786 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the placeholder URL with the verified, official repository URL controlled by the named publisher. 2. Pin installation to a specific reviewed commit hash or immutable, cryptographically signed release. 3. Publish expected checksums or signatures and require users to verify them before copying files into the skills directory. 4. Clone into a staging directory first, inspect the complete file set, and only then install the reviewed files. 5. Configure OpenClaw to require explicit trust approval before loading newly installed skills. 6. Ensure the official repository contents exactly match the artifact subjected to security review. 7. Include the actual implementation in future audit submissions so configuration mutation, model-name handling, backup creation, and service-restart behavior can be assessed.