T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:48
- Finding
- Unpinned Third-Party Plugin Installation and Activation## Vulnerability Details **File Location**: `SKILL.md`, lines 48-50 **Vulnerability Type**: Unpinned and automatically activated third-party dependency **Risk Level**: Medium ### Vulnerable Code ```bash openclaw plugins install clawhub:clawlink-plugin openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json openclaw gateway restart ``` ### Technical Analysis The installation command identifies `clawlink-plugin` without an immutable version, cryptographic digest, or documented signature-verification requirement. The following commands explicitly allow the installed plugin and restart the OpenClaw gateway, activating the retrieved dependency. Because the dependency reference is mutable, the code executed by users can change after this Skill has been audited. A compromised publisher account, package registry, distribution pipeline, or later malicious release could cause different plugin code to be installed under the same package name. The file does not independently verify the package contents before activation. No malicious content was found inside the audited project itself; the risk arises from the external dependency and installation process. ### Attack Path 1. An attacker compromises the plugin publisher account, ClawHub package entry, or associated distribution infrastructure. 2. The attacker publishes a malicious plugin release under the existing `clawlink-plugin` identifier. 3. A user follows the Skill instructions and runs the unpinned installation command. 4. OpenClaw retrieves the attacker-controlled release because no immutable version or digest is specified. 5. The user allowlists the plugin through `tools.alsoAllow`. 6. The gateway restart activates the malicious plugin. 7. The plugin can then abuse whatever tool, network, credential-broker, and local process privileges the OpenClaw plugin runtime grants it. ### Impact Assessment Successful exploitation could permit attacker-contr ...[truncated 764 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the plugin to a specific, audited version rather than a mutable package identifier. 2. Prefer an immutable cryptographic digest or content hash in addition to a version number. 3. Require verification of the package publisher and package signature before installation. 4. Publish the expected digest and a reproducible procedure for checking it locally. 5. Separate installation from activation so users can inspect and approve the installed package before it is allowlisted. 6. Avoid restarting the gateway automatically until dependency integrity has been verified. 7. Restrict the plugin to the minimum required tool, filesystem, network, and credential permissions. 8. Maintain a reviewed version allowlist and document a rollback and revocation procedure for compromised releases.