T08 · Insecure Dependencies
Error
- Location
- SKILL.md:23
- Finding
- Unpinned Third-Party npm Package Is Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 23–37 and 78–80 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```bash # Lines 23–26 Run the following command on the skill directory: npx clawguard scan <path-to-skill-directory> # Lines 29–32 For JSON output (useful for programmatic analysis): npx clawguard scan <path-to-skill-directory> --json # Lines 35–38 To check only specific rules: npx clawguard scan <path-to-skill-directory> --rules prompt-injection,data-exfiltration # Lines 78–80 - Always scan BEFORE installation, never after - If ClawGuard is not installed, run `npm install -g clawguard` first ``` ### Technical Analysis The Skill directs the agent to execute `clawguard` through `npx` or install it globally without specifying an exact version, integrity value, lockfile, or verified artifact. If the package is absent locally, `npx` can retrieve the current package release from the configured npm registry and execute its CLI, including applicable package lifecycle behavior, with the invoking user's permissions. Consequently, the code executed during a future scan is not fixed to the artifact reviewed here and may change after this audit. A compromised maintainer account, registry package compromise, malicious future release, or poisoned registry configuration could turn the mandatory security scan into a supply-chain execution channel. The scanner legitimately requires access to the directory being audited, but unrestricted execution under the agent's normal account can expose substantially more resources than that purpose requires. The global installation instruction is also unnecessary for ordinary scanning and creates a persistent user- or system-level package installation. The references to `~/.ssh`, `~/.aws`, and `curl | sh` elsewhere in `SKILL.md` are descriptions of patterns the scanner detects. They do not themsel ...[truncated 1516 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the scanner to a reviewed exact version, for example `npx --yes clawguard@0.1.0 scan ...`, rather than resolving the latest release implicitly. 2. Verify the selected package version, publisher, provenance, and registry integrity metadata before documenting it. 3. Prefer a project-local dependency governed by a committed lockfile and integrity hashes over an ad hoc or global installation. 4. Remove the `npm install -g clawguard` instruction. If installation is required, use an isolated temporary project or a reproducible container image. 5. Run the scanner in a sandbox with read-only access limited to the target directory. Deny access to SSH keys, cloud credentials, unrelated home-directory files, and unnecessary environment variables. 6. Disable network access during the actual scan where feasible, separating verified package acquisition from package execution. 7. Re-audit the package and update the pinned version deliberately when upgrades are required. Version pinning alone does not establish trust; the pinned artifact must also be reviewed or cryptographically verified.