T08 · Insecure Dependencies
Error
- Location
- SKILL.md:4
- Finding
- Unpinned Globally Installed OAuth CLI Dependency## Vulnerability Details **File Location**: `SKILL.md:4`, `SKILL.md:52`; duplicated in `references/commands.md:12` **Vulnerability Type**: Unpinned third-party dependency with global installation and access to sensitive OAuth credentials **Risk Level**: High ### Vulnerable Code `SKILL.md:4`: ```yaml metadata: {"openclaw":{"emoji":"🔐","homepage":"https://auth.clawauth.app","requires":{"bins":["clawauth"]},"install":[{"id":"node","kind":"node","package":"clawauth","bins":["clawauth"],"label":"Install clawauth CLI (node)"}]}} ``` `SKILL.md:52`: ```bash npm i -g clawauth ``` `references/commands.md:12`: ```bash npm i -g clawauth ``` ### Technical Analysis Both the managed installation metadata and manual fallback install the current version of the third-party `clawauth` npm package without specifying an exact version, cryptographic integrity value, signature, or operator-controlled artifact source. Consequently, the effective executable can change after the Skill itself has been reviewed. The use of global installation increases the consequences of dependency compromise because npm installation lifecycle scripts and the installed CLI execute with the permissions of the package manager invocation. The dependency is particularly security-sensitive: according to the Skill, it creates remote OAuth sessions, claims token payloads, and stores reusable credentials in the operating-system keychain. A compromised or unexpectedly modified package could therefore access credentials at the point where they are decrypted or claimed, regardless of the documented end-to-end encryption model. The repository does not include the CLI implementation, so its claimed encryption, server-side deletion, keychain handling, and network behavior cannot be independently verified from the audited files. There is no evidence in the reviewed project that the current package is malicious; the vulnerability is the unsafe, mutable trust relationshi ...[truncated 2058 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an exact, reviewed version in installation metadata and manual instructions, for example `clawauth@X.Y.Z`; do not use version ranges or implicit latest-version resolution. 2. Require cryptographic integrity verification for the package tarball and reject installation if the expected digest does not match. 3. Retrieve the package through an operator-controlled registry or immutable artifact repository after source review and malware scanning. 4. Verify package provenance and signatures in the build pipeline, and retain an auditable mapping between source commit, build artifact, package version, and digest. 5. Preinstall the approved artifact in a hardened runtime image rather than downloading it during Skill execution. 6. Disable npm lifecycle scripts during installation where compatible, or separately audit every required lifecycle script. 7. Avoid administrative installation privileges. Prefer a dedicated, minimally privileged runtime account and a controlled executable directory over unrestricted global installation. 8. Vendor or reference the exact CLI source corresponding to the approved artifact so that encryption, network destinations, claim behavior, server deletion, and keychain access can be independently audited. 9. Restrict outbound network access to documented OAuth providers and `auth.clawauth.app`, subject to verified redirect requirements, and monitor for unexpected destinations. 10. Limit requested OAuth scopes to the minimum needed for each task, isolate keychain entries, redact command output, and establish a token-revocation procedure for suspected package compromise. 11. Update both `SKILL.md` and `references/commands.md` together so the manual fallback cannot bypass the pinned installation policy.