T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:22
- Finding
- Unpinned Third-Party Plugin Installed as the Active Memory Provider## Vulnerability Details **File Location**: `SKILL.md`, lines 22–26 **Vulnerability Type**: Unpinned third-party dependency with privileged memory integration **Risk Level**: Medium ### Vulnerable Code ```sh openclaw plugins install @clawmem-ai/clawmem openclaw plugins enable clawmem openclaw config set plugins.slots.memory clawmem openclaw config validate openclaw gateway restart ``` ### Technical Analysis The installation command references `@clawmem-ai/clawmem` without pinning an audited version or verifying an integrity digest or signature. The resolved package can therefore change between installations even though the documented command remains unchanged. The dependency is subsequently enabled and selected as OpenClaw's active memory provider. The remainder of the setup document indicates that the plugin provisions per-agent repository routes and authentication tokens. This makes compromise of the dependency materially more significant than installation of an isolated, unprivileged library. The plugin implementation is not included in the audited project, so its behavior and controls could not be independently reviewed. This finding does not establish that the current package is malicious; it identifies a supply-chain weakness through which a future compromised or unauthorized release could be installed. ### Attack Path 1. An attacker compromises the package publisher, package registry account, distribution infrastructure, or another component of the plugin's release chain. 2. The attacker publishes a malicious version under the existing `@clawmem-ai/clawmem` package name. 3. An operator follows the setup instructions, and the unpinned installation command resolves the attacker-controlled release. 4. The instructions enable the installed package and assign it to `plugins.slots.memory`. 5. OpenClaw restarts and loads the compromised plugin. 6. Malicious plugin code can then attempt to read or alter memory d ...[truncated 850 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the plugin to a specific, reviewed version rather than installing the mutable package name alone. 2. Verify the release with a trusted cryptographic digest or signature before installation. 3. Maintain an approved-version policy and test upgrades in an isolated environment before deployment. 4. Review the distributed plugin source and package contents before enabling it. 5. Restrict plugin filesystem, network, configuration, token, and memory permissions according to least privilege. 6. Store per-agent tokens in an appropriate secret store and limit their repository scopes and operations. 7. Require explicit operator confirmation before replacing the active memory provider or restarting the gateway. 8. Monitor package provenance and rotate affected credentials immediately if a dependency compromise is suspected.