T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:51
- Finding
- Unpinned Third-Party Plugin Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 51–55 **Vulnerability Type**: Unpinned executable dependency installed from an external package registry **Risk Level**: Medium ### Vulnerable Code ```bash openclaw plugins install clawhub:clawlink-plugin openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json openclaw gateway restart ``` ### Technical Analysis The setup instructions install an externally maintained executable plugin using the mutable identifier `clawhub:clawlink-plugin`. They then add that plugin to OpenClaw's allowed tool configuration and restart the gateway, causing the downloaded component to become active. The audited project does not contain the plugin's source code, an immutable version, a cryptographic checksum, signature-verification instructions, or other material that would allow the installed artifact to be matched to a reviewed release. Although the documentation describes the plugin as verified, that assertion cannot be independently established from the project contents. This creates a supply-chain trust boundary: the effective behavior loaded into OpenClaw depends on the package registry, publisher account, and plugin release available when installation occurs. That behavior may change after this skill has been reviewed. ### Attack Path 1. An attacker compromises the plugin publisher account, distribution registry, release process, or another component of the plugin supply chain. 2. The attacker publishes a modified plugin under the mutable `clawhub:clawlink-plugin` identifier. 3. A user follows the documented installation command. 4. OpenClaw downloads the modified executable component without checking a project-specified version or checksum. 5. The configuration command explicitly adds the plugin to the allowed tool set. 6. Restarting the gateway loads and activates the compromised plugin. 7. The plugin may abuse its granted capabilities or intercept integration operations and data handled t ...[truncated 1028 chars]
- Remediation
- ## Remediation Suggestions 1. Pin installation to an immutable, security-reviewed plugin version rather than a mutable package identifier. 2. Publish the plugin source code and dependency lockfile so its effective behavior and transitive dependencies can be audited. 3. Provide a trusted cryptographic checksum or signed release manifest and verify it before installation. 4. Enforce publisher identity and package-signature verification through the plugin registry. 5. Document the exact registry, publisher, version, and expected artifact digest. 6. Restrict the plugin to the minimum permissions required for WhatsApp operations. 7. Separate read and write capabilities, and preserve explicit user confirmation for every message send or other state-changing operation. 8. Require explicit user approval before installing the plugin, changing the tool allowlist, or restarting the gateway. 9. Monitor plugin releases and revoke compromised versions through an allowlist or denylist mechanism.