T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:13
- Finding
- Unpinned Remote Installation Dependencies## Vulnerability Details **File Location**: `SKILL.md`, lines 13–25 **Vulnerability Type**: Supply-chain exposure through mutable remote dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # Install all skills from repo npx skills add https://github.com/barneyjm/camino-skills # Or install specific skills npx skills add https://github.com/barneyjm/camino-skills --skill camino-relationship ``` ```bash npx clawhub@latest install camino-relationship # or: pnpm dlx clawhub@latest install camino-relationship # or: bunx clawhub@latest install camino-relationship ``` ### Technical Analysis The documented installation commands retrieve packages or Skill content from mutable upstream references. The GitHub commands do not specify a reviewed commit or immutable release, while the package-runner commands explicitly request `@latest`. No checksum, signature, lockfile, or other integrity-verification mechanism is documented. Consequently, the content installed by users can differ from the content reviewed during this audit. This is an insecure dependency practice rather than evidence that the currently audited script contains an embedded malicious payload. ### Attack Path 1. An attacker compromises the upstream repository, registry package, maintainer account, release process, or another relevant supply-chain component. 2. The attacker publishes malicious content to the repository's mutable default reference or to the package version selected by `@latest`. 3. A user follows the installation instructions in `SKILL.md`. 4. `npx`, `pnpm dlx`, or `bunx` retrieves the changed package, or the installer retrieves changed Skill content from GitHub. 5. Depending on the upstream package's installation and execution behavior, attacker-controlled code or Skill instructions are executed or installed in the user's environment. ### Impact Assessment The potential impact is determined by the privileges of the user run ...[truncated 720 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with an explicitly reviewed package version. 2. Pin the GitHub dependency to an immutable commit hash or signed release tag rather than the repository's mutable default reference. 3. Publish expected checksums or cryptographic signatures and verify them before installation. 4. Use package-manager lockfiles and integrity metadata where supported. 5. Install only the required Skill instead of the complete collection unless all included Skills have been independently reviewed. 6. Document the expected publisher, version, commit, and integrity value so users can verify provenance. 7. Run installation with the minimum necessary privileges in an isolated environment, and review package lifecycle scripts before execution.