T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:47
- Finding
- Unpinned Third-Party Plugin Installation and Allowlisting## Vulnerability Details **File Location**: `SKILL.md`, lines 47–49; repeated at lines 221–222 **Vulnerability Type**: Unpinned third-party dependency installed from an external package registry **Risk Level**: Medium ### Vulnerable Code ```bash openclaw plugins install clawhub:clawlink-plugin openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json openclaw gateway restart ``` The installation and gateway restart are repeated in the troubleshooting workflow: ```bash openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json openclaw gateway restart ``` ### Technical Analysis The skill instructs users to install `clawhub:clawlink-plugin` without specifying an immutable version or integrity digest. It then explicitly allowlists that plugin and restarts the OpenClaw gateway, causing the installed component to be loaded. Because the dependency is mutable and its implementation is outside the audited project, future installations may retrieve code different from the code originally reviewed. A compromise of the package, publisher account, distribution registry, or update channel could therefore introduce malicious behavior without requiring changes to `SKILL.md`. The plugin is intended to mediate OAuth-authenticated YouTube operations. Consequently, dependency provenance and integrity are security-sensitive even though the reviewed file contains no embedded malicious code. The documentation’s write-confirmation workflow reduces accidental modifications but cannot protect against a compromised plugin that disregards those controls. ### Attack Path 1. An attacker compromises the plugin publisher, package registry, distribution channel, or another component capable of replacing the mutable `clawlink-plugin` package. 2. The attacker publishes a malicious build under the same unversioned package identifier. 3. A user follows the skill instructions and installs `clawhub:clawlink-plugin`. 4. The user allowlists the plugin through `too ...[truncated 1134 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the plugin to an audited, immutable version rather than installing an unversioned package. 2. Verify the package with a cryptographic integrity digest or signed provenance record before installation. 3. Document the expected publisher identity, registry origin, version, checksum, and verification procedure. 4. Require review or explicit approval before adding the plugin to `tools.alsoAllow` and restarting the gateway. 5. Apply least-privilege OAuth scopes so the plugin receives only permissions required for the requested operation. 6. Separate read-only and write-capable authorization where supported, granting write access only when necessary. 7. Run the plugin in a restricted sandbox with limited filesystem, network, process, and credential access. 8. Establish a trusted update policy that reviews new releases before changing the pinned version. 9. Provide revocation instructions for the plugin authorization and connected Google account tokens.