T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:35
- Finding
- Unpinned Third-Party Tool Execution and Overbroad Skill Updates## Vulnerability Details **File Location**: `SKILL.md`, lines 35–43 **Vulnerability Type**: Supply-chain exposure through mutable dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npx -y clawhub@latest install github-api npx -y clawhub@latest install vercel npx -y clawhub@latest install netlify npx -y clawhub@latest install domain-dns-ops npx -y clawhub@latest install api-gateway npx -y clawhub@latest update --all ``` ### Technical Analysis The documented commands use `npx -y clawhub@latest`, which downloads and executes the package version currently associated with the mutable `latest` tag. The project provides no lockfile, integrity hash, signature requirement, or fixed package version to ensure that the executed package is the same version that was previously reviewed. Although the skill documentation identifies inspected versions of its upstream skills, the installation commands do not pin those versions. Consequently, users may install later and materially different releases without an intervening security review. The `update --all` command further expands the trust boundary by updating every installed skill rather than only the dependencies required by this skill. This can modify unrelated Agent capabilities and increases exposure to compromised, malicious, or unexpectedly changed upstream components. ### Attack Path 1. An attacker compromises the `clawhub` npm package, its publishing account, the mutable `latest` release, or an upstream skill release. 2. A user follows the installation instructions in `SKILL.md`. 3. `npx` retrieves and executes the attacker-controlled or unexpectedly modified package without an interactive confirmation because of the `-y` option. 4. The installation process installs modified skills or performs malicious package lifecycle behavior with the privileges of the invoking user. 5. If `update --all` is executed, unrelated installed skills may also be replaced with unreviewed versions. 6. The compromised pac ...[truncated 715 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `clawhub@latest` with an exact, reviewed version: ```bash npx -y clawhub@<reviewed-exact-version> install ... ``` 2. Pin each installed skill to the exact versions recorded as inspected, where the CLI supports version selection. 3. Verify npm package integrity through a committed lockfile, trusted registry configuration, integrity hashes, or package signatures. 4. Remove `npx -y clawhub@latest update --all` from the standard installation workflow. 5. Update only the explicitly required skills, one at a time, after reviewing their version changes. 6. Run installation with the least-privileged account available and avoid exposing unrelated credentials to the installation process. 7. In controlled environments, mirror approved package artifacts in a trusted registry and permit only reviewed versions. 8. Document a review and rollback procedure for dependency upgrades.