T08 · Insecure Dependencies
Warning
- Location
SKILL.md:16- Finding
Unpinned Third-Party Package Execution Through npx
- Content
View full analysis
- Build a high-efficiency rocket mass heater that cuts fuel use by 80% and delivers 24+ hours of radiant heat using scrap wood and local materials. display_name: "Rocket Mass Heater Construction" submitted_by: HowToUseHumans last_reviewed: "2026-03-31" openclaw: requires: tools: [filesystem] install: "npx clawhub install rocket-mass-heater-construction" --- # Rocket Mass Heater Construction Build a professional-grade, ultra-efficient wood-burning heater using the rocket stove principle combined with massive thermal mass. This system burns small sticks and scraps cleanly at 1,000°F+, stores heat in cob or stone, and radiates warmth for days — perfect for off-grid homes, workshops, or emergency resilience when fuel and electricity are scarce. `npx clawhub install rocket-mass-heater-construction` ``` ### Technical Analysis The documented installation command invokes `clawhub` through `npx` without specifying an audited version, package integrity hash, lockfile, or verified distribution source. Depending on the local npm configuration and cache state, `npx` can retrieve the current package version from a configured registry and execute its CLI code. The effective executable payload is therefore outside the reviewed project and may change independently after this Skill has been audited. The audit found no evidence that the package is currently malicious, but the mutable dependency and immediate execution create a supply-chain exposure. Package compromise, ownership transfer, registry account compromise, or malicious registry configuration could cause unreviewed code to execute. ### Attack Path 1. An attacker compromises the `clawhub` package, its publisher account, its dependency chain, or the package registry us ...[truncated 1117 chars]- Remediation
View remediation
install rocket-mass-heater-construction ``` 2. Document the expected official registry and verified package source. 3. Use npm lockfiles and integrity metadata where the installation workflow supports them. 4. Verify the downloaded package checksum, provenance, and publisher signature before execution. 5. Review package lifecycle scripts and the complete transitive dependency tree for the pinned release. 6. Prefer a preinstalled, organization-approved `clawhub` binary over downloading and executing code during installation. 7. Run installation with least privilege in a sandbox or isolated environment without production credentials. 8. Establish a controlled upgrade process in which new dependency versions are reviewed before the pinned version is changed. ]]>