T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:48
- Finding
- Unpinned Third-Party Plugin Is Trusted with Credentials and Remote Tool Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 48–136 **Vulnerability Type**: Unpinned and externally controlled dependency **Risk Level**: Medium ### Vulnerable Code ```bash openclaw plugins install clawhub:clawlink-plugin openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json openclaw gateway restart ``` ```markdown All Zyte API tool calls are authenticated automatically by ClawLink using the user's connected Zyte API credentials. **No API key is required in chat.** ClawLink stores the credentials securely and injects them into every Zyte API request on the user's behalf. ### Getting Connected 1. Install the ClawLink plugin (see Install above). 2. Pair the plugin with `clawlink_begin_pairing` if it is not configured yet. 3. Open https://claw-link.dev/dashboard?add=zyte-api and connect Zyte API. 4. Call `clawlink_list_integrations` to verify the connection is active. ``` ```markdown ## Discovery Workflow 1. Call `clawlink_list_integrations` to confirm Zyte API is connected. 2. Call `clawlink_list_tools --integration zyte-api` to see the live catalog. 3. Treat the returned list as the source of truth. Do not guess or assume what tools exist. 4. If the user describes a capability but the exact tool is unclear, call `clawlink_search_tools` with a short query and integration `zyte-api`. 5. If no Zyte API tools appear, direct the user to https://claw-link.dev/dashboard?add=zyte-api. ## Execution Workflow 1. For unfamiliar tools, ambiguous requests, or any write action, call `clawlink_describe_tool` first. 2. Use the returned guidance, schema, `whenToUse`, `askBefore`, `safeDefaults`, `examples`, and `followups` to shape the call. 3. Prefer targeted extraction and status checks before broad or repeated scraping requests. 4. For writes or anything marked as requiring confirmation, call `clawlink_preview_tool` first. 5. Execute with `clawlink_call_tool`. Pass confirmation only after the preview matches the user's int ...[truncated 3182 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `clawlink-plugin` to a specific, reviewed version rather than installing an implicitly mutable latest release. 2. Verify the package using a cryptographic digest and a trusted publisher signature before installation. 3. Publish or reference the exact reproducible source revision corresponding to the installed artifact. 4. Provide a permission manifest documenting filesystem, network, credential, configuration, and tool-execution access. 5. Maintain a local allowlist of approved Zyte tool identifiers and schemas instead of treating an unrestricted remote catalog as authoritative. 6. Validate remotely returned tool definitions against pinned schemas, including parameter types, confirmation requirements, and permitted destinations. 7. Require explicit, informed user approval before plugin installation, configuration modification, gateway restart, account pairing, or access to account and usage information. 8. Scope credentials to the minimum required Zyte permissions and use short-lived, revocable tokens where supported. 9. Prevent the plugin from exposing raw credentials to tool output, logs, error messages, or unrelated integrations. 10. Record and audit plugin installation, catalog changes, credential use, and API operations. 11. Define an update policy that requires renewed review and integrity verification before activating a new plugin version. 12. Avoid automatic gateway restarts; clearly disclose their operational effect and require separate user confirmation. ]]>