T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:21
- Finding
- Unpinned Third-Party Plugin Installation Recommendation## Vulnerability Details **File Location**: `SKILL.md`, lines 21–34 **Vulnerability Type**: Supply-chain risk from an unpinned external dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ## Recommended: Install the Plugin **For the best experience, install the OpenClaw plugin for LinkedIn API instead of this skill.** The plugin provides native MCP tools, automatic authentication, and structured parameter validation. Skill (this document): ```bash clawhub install agntdata-linkedin ``` Plugin (native tools; npm package matches `package.json`): ```bash openclaw plugins install @agntdata/openclaw-linkedin ``` ``` ### Technical Analysis The Skill recommends installing `@agntdata/openclaw-linkedin` without specifying an exact version or an integrity hash. The resulting installation is mutable: its contents depend on whichever package release the registry resolves at installation time rather than the artifact reviewed during this audit. The external plugin's implementation is not included in the audited project. Although the documentation states that the npm package matches `package.json`, the audited directory contains only `SKILL.md` and `_meta.json`; there is no `package.json`, lockfile, vendored source, signature, or checksum against which the installed plugin can be verified. This creates a supply-chain trust boundary. A compromised registry account, malicious future release, or package takeover could cause users following the recommendation to install code that was not subject to this audit. ### Attack Path 1. An attacker compromises the package maintainer account, package publication workflow, or another relevant supply-chain component. 2. The attacker publishes a malicious version of `@agntdata/openclaw-linkedin`. 3. A user follows the Skill's recommended installation command. 4. Because the command does not pin a reviewed version or verify an integrity hash, the package manager resolves and installs the malicious release. 5. The ...[truncated 1034 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an exact, reviewed version, for example: ```bash openclaw plugins install @agntdata/openclaw-linkedin@1.0.15 ``` 2. Publish and verify a cryptographic integrity hash or signed release provenance before installation. 3. Include the plugin's source, manifest, and lockfile in the auditable project, or link to immutable source at a specific commit. 4. Remove or correct the statement that the package matches `package.json` unless that file is actually included and identifies the exact reviewed dependency. 5. Require explicit user confirmation before installing external executable components. 6. Run the plugin with least privilege, restricting environment-variable access, filesystem access, network destinations, and available agent tools. 7. Ensure `AGNTDATA_API_KEY` is exposed only when an authenticated agntdata request is necessary, and support narrowly scoped, revocable credentials where available. 8. Maintain dependency monitoring and revoke or block compromised versions promptly.