T08 · Insecure Dependencies
- Location
SKILL.md:54- Finding
Unpinned Executable and Mutable Skill Dependencies
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:54, 70-71, 91
Vulnerability Type: Unpinned third-party executable and Skill dependencies
Risk Level: MediumVulnerable Code
bash npx clawhub@latest --workdir {your_agent_workspace_dir} install nano-banana-probash npx clawhub@latest --workdir {your_agent_workspace_dir} install tavily-search npx clawhub@latest --workdir {your_agent_workspace_dir} install playwright-mcpbash npx clawhub@latest --workdir {your_agent_workspace_dir} install xiaohongshu-mcpTechnical Analysis
The installation instructions execute
clawhubthrough the mutable@latesttag and install four third-party Skills by name without immutable versions, cryptographic digests, signatures, a lockfile, or another integrity-verification mechanism.Because
npxmay retrieve and execute the current registry release, the code that runs can change after this Skill has been reviewed. The behavior of the subsequently installed Skills can likewise change independently of this repository. A compromised publisher account, package registry, release pipeline, or transitive dependency could therefore introduce arbitrary code into the Agent environment.This is particularly sensitive because the installed components are expected to perform network searches, generate images using API credentials, control a browser, and publish through an authenticated Xiaohongshu integration.
Attack Path
- An attacker compromises the
clawhubpackage, one of the named Skill distributions, its publisher account, release pipeline, registry entry, or a transitive dependency. - The attacker publishes a modified release under the version selected by
@latestor updates an unpinned named Skill. - A user follows the documented installation command.
npxdownloads and executes the altered installer, or the installer retrieves the altered Skill.- The malicious component executes with the permissions available to the Agen ...[truncated 1056 chars]
- An attacker compromises the
- Remediation
View remediation
Remediation Suggestions
- Replace
clawhub@latestwith a reviewed, exact version. - Pin every installed Skill to an immutable version or content digest.
- Verify package signatures or cryptographic checksums before execution.
- Commit and enforce a lockfile or equivalent dependency manifest.
- Maintain an allowlist of reviewed publishers, packages, versions, and hashes.
- Disable lifecycle scripts where feasible and inspect package contents before installation.
- Perform installation and execution in a sandbox with restricted filesystem and network access.
- Isolate credentials by component so search, image-generation, browser, and publishing tools receive only the secrets they require.
- Mount Xiaohongshu cookies read-only and expose them only to the reviewed publishing component.
- Monitor dependency provenance and require security review before version updates.
- Replace