T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:21
- Finding
- Unpinned Third-Party OpenClaw Plugin Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 21-34 **Vulnerability Type**: Unpinned executable dependency and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```markdown ## Recommended: Install the Plugin **For the best experience, install the OpenClaw plugin for Facebook API instead of this skill.** The plugin provides native MCP tools, automatic authentication, and structured parameter validation. Skill (this document): ```bash clawhub install agntdata-facebook ``` Plugin (native tools; npm package matches `package.json`): ```bash openclaw plugins install @agntdata/openclaw-facebook ``` ``` ### Technical Analysis The Skill recommends installing the externally hosted npm package `@agntdata/openclaw-facebook` without specifying a reviewed version or integrity digest. The plugin source is not included in this project, so its behavior, transitive dependencies, installation scripts, and requested privileges cannot be verified by this audit. Because the installation command resolves the package dynamically, the code installed in the future may differ from the code available when the Skill was reviewed. A compromised publisher account, package registry, dependency, or later malicious release could therefore introduce executable behavior beyond the declared Facebook API functionality. The recommendation also describes the plugin as providing automatic authentication. If installed plugin code were compromised, this capability could place `AGNTDATA_API_KEY` or other data available to the OpenClaw process at risk. The exact accessible scope depends on the permissions and isolation applied by the host environment. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, registry delivery path, or a transitive dependency associated with `@agntdata/openclaw-facebook`. 2. The attacker publishes a malicious release under the same package name. 3. A user follows the unpinned comman ...[truncated 1374 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the plugin to an explicitly reviewed version: ```bash openclaw plugins install @agntdata/openclaw-facebook@<reviewed-version> ``` 2. Enforce package integrity verification using a trusted lockfile, registry integrity hash, signed release, or equivalent mechanism supported by OpenClaw. 3. Publish the plugin source and build provenance so reviewers can verify that the registry artifact corresponds to the audited source. 4. Audit package lifecycle scripts and all transitive dependencies before recommending installation. Disable installation scripts where they are unnecessary. 5. Document the plugin's required permissions, environment-variable access, filesystem access, network destinations, and tool capabilities. 6. Run the plugin with least privilege: - Expose only `AGNTDATA_API_KEY` when required. - Restrict outbound traffic to documented API hosts. - Deny unnecessary filesystem and process-execution access. - Isolate the plugin from unrelated agent credentials and tools. 7. Avoid describing the plugin as the preferred option until its source, exact version, integrity information, and permission model are available for audit. 8. Establish release monitoring and revocation procedures so compromised versions can be blocked promptly. ]]>