T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unverified Third-Party CLI Installed Globally from a Custom Registry<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 5-17 **Vulnerability Type**: Supply-chain exposure through an unverified third-party dependency **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"💰","requires":{"bins":["freshbooks"]},"install":[{"id":"npm","kind":"node","package":"@haseebuchiha/freshbooks-cli","bins":["freshbooks"],"label":"Install freshbooks-cli (npm)"}]}} ``` ```markdown ## Install ```bash npm install -g @haseebuchiha/freshbooks-cli ``` Requires `.npmrc` with `@haseebuchiha:registry=https://npm.pkg.github.com` for GitHub Package Registry. ``` ### Technical Analysis The Skill directs users to globally install `@haseebuchiha/freshbooks-cli`, a personally scoped third-party package retrieved from a custom GitHub Packages registry. The package's implementation and a lockfile, exact version constraint, or integrity hash are not included in the audited project. Consequently, the executable code and npm lifecycle scripts installed by this instruction cannot be verified from the reviewed artifact. An unpinned package reference allows the registry-resolved implementation to change after this Skill has been reviewed. If the package publisher account, registry, release process, or package itself is compromised, a malicious release could execute code during npm installation or whenever the `freshbooks` command is invoked. The risk is particularly relevant because the documented CLI receives FreshBooks OAuth client credentials and obtains tokens that are stored under `~/.config/freshbooks-cli/config.json`. It also processes client and invoice information. The audit found no direct evidence that the referenced package is malicious; the vulnerability is the unauditable and mutable supply-chain trust boundary. ### Attack Path 1. An attacker compromises the package publisher, package registry, publishing credentials, or release pipeline, or otherwise causes a malicious package version to be s ...[truncated 1408 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Include the CLI source code in an auditable repository or provide a verifiable link to the exact reviewed source revision. 2. Pin the dependency to a specific immutable version rather than allowing the registry to resolve a mutable latest release. 3. Record and verify the package archive's cryptographic integrity hash before installation. 4. Use a lockfile or equivalent signed dependency manifest where the installation system supports it. 5. Publish packages through a protected release pipeline with multifactor authentication, provenance attestations, signed releases, and restricted publisher permissions. 6. Review the package's npm lifecycle scripts and disable lifecycle scripts with `--ignore-scripts` when they are not required. 7. Avoid global installation where practical. Install the CLI in an isolated, least-privileged environment with restricted filesystem and network access. 8. Ensure OAuth scopes are limited to the minimum operations required by the Skill. 9. Keep FreshBooks secrets out of shell history and process arguments where possible; prefer protected environment injection or secure interactive input. 10. Add dependency monitoring and require security review before updating the pinned package version. ]]>