T08 · Insecure Dependencies
Warning
- Location
- README.md:9
- Finding
- Unpinned npm Installers and Mutable Remote Skill Source<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 9–15 **Vulnerability Type**: Unpinned third-party executables and mutable remote installation source **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/cross-chain-arbitrage ``` Or via Clawhub: ```bash npx clawhub@latest install cross-chain-arbitrage ``` ### Technical Analysis The documented installation procedures execute npm-delivered command-line packages without immutable version or integrity pinning. The first command invokes the unpinned `skills` package through `npx` and installs skill content from a mutable GitHub branch path. Because the URL references `main` rather than a reviewed commit SHA, the content installed later can differ from the content audited in this project. The second command explicitly invokes `clawhub@latest`. The `latest` npm distribution tag is mutable and can resolve to a different package version whenever the command is run. Neither procedure specifies an expected package checksum, lockfile, signature, or other integrity verification mechanism. This does not establish that the current npm packages or repository are malicious. However, the installation guidance creates a supply-chain trust boundary in which future or compromised remote content can be executed or installed without matching the reviewed artifact. ### Attack Path 1. An attacker compromises a relevant npm publisher account, npm package, package distribution tag, GitHub repository, or repository maintainer account. 2. The attacker publishes a malicious version of `skills` or `clawhub`, moves the `latest` tag to it, or modifies the skill content on the referenced `main` branch. 3. A user follows the installation instructions in `README.md`. 4. `npx` downloads and executes the package selected at that time, or the installer retrieves the modified branch content. 5. Malicious installer logic executes with the privi ...[truncated 1082 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every npm CLI package to an exact reviewed version rather than relying on implicit resolution or `@latest`: ```bash npx --yes skills@<reviewed-exact-version> add <pinned-source> npx --yes clawhub@<reviewed-exact-version> install cross-chain-arbitrage ``` 2. Replace the mutable GitHub branch URL with an immutable commit reference: ```text https://github.com/wpank/Agentic-Uniswap/tree/<full-commit-sha>/.ai/skills/cross-chain-arbitrage ``` 3. Publish and verify cryptographic checksums or signatures for the expected package and skill artifact before installation. 4. Prefer downloading the artifact without executing it, reviewing its contents, and then installing it through a controlled local process. 5. Use a trusted lockfile or internal package mirror to preserve reviewed dependency versions and reduce registry compromise exposure. 6. Run installation under a non-privileged account in a sandbox or container with minimal filesystem and credential access. Do not recommend `sudo` or administrator execution. 7. Add upgrade guidance requiring a new review whenever the pinned npm version, repository commit, checksum, or signature changes. ]]>