T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:43
- Finding
- Unpinned Third-Party Plugin Installation and Global Enablement<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 43–51 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium The Skill directs users to install an externally maintained plugin without specifying an immutable version, checksum, signature, or content digest. It then adds that plugin to the OpenClaw tool allowlist and restarts the gateway. ### Vulnerable Code ```markdown ## Install Install the verified ClawLink plugin from ClawHub. After the user confirms, complete the full setup so ClawLink tools are visible in the next OpenClaw chat. ```bash openclaw plugins install clawhub:clawlink-plugin openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json openclaw gateway restart ``` ``` ### Technical Analysis The package reference `clawhub:clawlink-plugin` is not pinned to an audited version or immutable artifact digest. Consequently, the code installed at runtime may differ from the code that existed when this Skill was reviewed. The installed component is also explicitly added to the global tool allowlist before the OpenClaw gateway is restarted. This causes OpenClaw to load and expose behavior implemented by a third-party component whose source code is not included in the audited project. The project therefore transfers trust to the package registry, the publisher account, the dependency's release process, and any dependencies bundled with the plugin. The documentation describes the plugin as handling hosted authentication, OAuth credentials, and authenticated Monday.com API requests. A compromised plugin release could therefore operate at the privilege level granted to the plugin and the connected Monday.com account. No evidence in the audited file proves that the current ClawLink plugin is malicious. The vulnerability is the mutable, unverified supply-chain installation mechanism. ### Attack Path 1. An attacker compromises the plugin publisher account, package registry, release pi ...[truncated 1517 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the plugin to a reviewed, immutable version rather than installing the latest package by name. 2. Prefer an artifact identified by a cryptographic digest, such as SHA-256, and verify the digest before installation. 3. Require registry or publisher signatures and document how users can verify them. 4. Review and retain the source code and dependency manifest corresponding to the pinned release. 5. Generate and verify a software bill of materials for the plugin and its transitive dependencies. 6. Restrict `tools.alsoAllow` to the minimum required plugin and avoid granting unrelated tools or capabilities. 7. Configure the plugin with least-privilege Monday.com OAuth scopes appropriate to the requested operations. 8. Separate read-only and write-capable access where supported, and continue requiring explicit confirmation for every write or destructive operation. 9. Run the plugin in a sandbox with limited filesystem, network, process, and credential access. 10. Establish an explicit update process in which new plugin releases are reviewed and verified before the pinned version is changed. ]]>