T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:15
- Finding
- Unpinned Third-Party Package and Repository Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 15–26 **Vulnerability Type**: Unpinned and mutable third-party installation sources **Risk Level**: Medium ### Vulnerable Code ```bash # Install all skills from repo npx skills add https://github.com/barneyjm/camino-skills # Or install specific skills npx skills add https://github.com/barneyjm/camino-skills --skill camino-safety-checker ``` ```bash npx clawhub@latest install camino-safety-checker # or: pnpm dlx clawhub@latest install camino-safety-checker # or: bunx clawhub@latest install camino-safety-checker ``` ### Technical Analysis The documented installation commands execute package tooling and install content obtained from mutable remote sources. The GitHub repository URL is not pinned to an immutable commit, while the `@latest` package tag deliberately resolves to whichever release is current when the command runs. No version pin, commit hash, integrity digest, or signature-verification procedure is provided. Consequently, the code executed or installed by these commands may differ from the content that was audited. Installing all Skills from the repository further expands the trust boundary to companion Skills that are not present in this project artifact. This is a supply-chain weakness; the audited script itself does not contain evidence of an embedded malicious payload. ### Attack Path 1. An attacker compromises the upstream package, repository, release process, registry account, or maintainer credentials. 2. The attacker publishes malicious package code under the mutable `latest` tag or modifies the repository's current contents. 3. A user follows one of the documented `npx`, `pnpm dlx`, or `bunx` installation commands. 4. The package runner retrieves the attacker-controlled version and may execute its lifecycle or command-line code under the user's account. 5. The malicious installer can act with the filesystem, network, environmen ...[truncated 663 chars]
- Remediation
- ## Remediation Suggestions - Pin package runners to audited, exact package versions instead of using `@latest`. - Pin GitHub installations to an immutable, reviewed commit hash or signed release tag. - Provide cryptographic integrity hashes or signature-verification instructions for downloaded artifacts. - Install only the required Skill rather than the entire companion suite. - Review package lifecycle scripts and dependency trees before installation. - Use a lockfile where supported and enable registry provenance or signature verification. - Run installation with least privilege in an isolated environment without unnecessary credentials. - Establish a controlled update process in which new versions are reviewed before changing the documented pins.