T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unpinned Node Dependency Installed from a Mutable GitHub Repository## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Supply-chain risk caused by an unpinned dependency from a mutable source **Risk Level**: Medium **Complete Code Snippet**: ```yaml metadata: {"clawdbot":{"emoji":"📝","requires":{"bins":["qmd"]},"install":[{"id":"node","kind":"node","package":"https://github.com/tobi/qmd","bins":["qmd"],"label":"Install qmd (node)"}]}} ``` ### Technical Analysis The installation metadata references `https://github.com/tobi/qmd` without specifying an immutable commit hash, versioned release, lockfile, or integrity checksum. Consequently, the dependency retrieved during a future installation may differ from the code that was originally reviewed. This creates a supply-chain trust boundary in which the effective installed package is controlled by the current state of an external repository. If that repository, its maintainer account, or its release process is compromised, an attacker could introduce malicious package lifecycle scripts or executable CLI code. The Skill itself contains no embedded malicious code; the risk arises from the mutable external dependency. ### Attack Path 1. An attacker compromises the upstream GitHub repository, a maintainer account, or another component of its publishing workflow. 2. The attacker modifies the repository content or Node package metadata to include malicious installation or runtime behavior. 3. A user installs the dependency through the Skill metadata, which retrieves the mutable upstream state rather than a previously reviewed immutable revision. 4. Malicious code executes through a Node lifecycle script during installation or when the user invokes the installed `qmd` binary. 5. The code operates with the permissions of the installing or invoking user and can access resources available to that account. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the ...[truncated 399 chars]
- Remediation
- ## Remediation Suggestions - Pin the dependency to a reviewed, immutable Git commit or an exact package release rather than the repository's mutable default branch. - Prefer a trusted package-registry artifact with an exact version and a committed lockfile. - Record and verify an integrity hash or checksum for the downloaded package. - Review the pinned source and all transitive dependencies before approving updates. - Disable Node lifecycle scripts during installation where operationally feasible, or explicitly audit every required lifecycle script. - Introduce an update process that separately reviews, tests, and approves each dependency revision before changing the pin. - Run installation and the resulting CLI with least privilege and avoid administrator or root execution.