T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:27
- Finding
- Execution of Unpinned Third-Party CLI Packages and Skill Updates## Vulnerability Details **File Location**: `SKILL.md`, lines 27-30, 36, and 61-62 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash npx -y clawhub@latest install frontend-design-ultimate npx -y clawhub@latest install shadcn-ui npx -y clawhub@latest install react-expert npx -y clawhub@latest update --all ``` ```bash npx -y clawhub@latest list ``` ```bash npx shadcn@latest init npx shadcn@latest add card button badge tabs table sheet sidebar ``` ### Technical Analysis The documented setup workflow instructs users or agents to execute npm packages through `npx` using the mutable `latest` tag. The `-y` option also suppresses the interactive installation confirmation for the ClawHub commands. An `npx` invocation can download and execute package code, including CLI entry points and relevant installation lifecycle behavior, with the permissions of the invoking user. Because `latest` can resolve to a different release at any time, the code ultimately executed is not necessarily the version that was reviewed. This is particularly significant because the document states that specific upstream skill versions were inspected, but the installation commands do not pin those versions. The `update --all` command further permits all installed skills to be replaced with later, unreviewed versions. No lockfile, package-integrity validation, checksum verification, or post-download review step is specified. This finding does not establish that the named packages are currently malicious. The vulnerability is the unsafe, mutable trust boundary through which compromised or unexpectedly changed upstream code could be executed after this skill was reviewed. ### Attack Path 1. An attacker compromises an upstream npm package, its publisher account, a transitive dependency, or an associated skill release. 2. The attacker publishes a malicious version that becomes the package's ...[truncated 1468 chars]
- Remediation
- ## Remediation Suggestions 1. Replace every `@latest` reference with an explicitly reviewed package version, for example `clawhub@X.Y.Z` and `shadcn@X.Y.Z`. 2. Pin the installed upstream skills to the exact versions documented as inspected rather than silently selecting newer releases. 3. Remove `npx -y clawhub@latest update --all`. Update each dependency individually only after reviewing its release, provenance, and content. 4. Avoid suppressing confirmation with `-y` for security-sensitive installation and update operations. 5. Use a committed lockfile and deterministic package installation where the surrounding project supports it. 6. Verify npm package provenance and integrity metadata before execution. For higher-assurance environments, download and inspect the package without running it, then compare an approved checksum or artifact digest. 7. Review downloaded skill files before enabling them, especially scripts, executable hooks, tool instructions, and changes to required permissions. 8. Execute installation tooling in a minimally privileged, isolated environment without production secrets or unrelated credentials. 9. Document a controlled upgrade process requiring review and approval whenever a pinned CLI, skill, or transitive dependency changes.