T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:12
- Finding
- Unpinned Third-Party Installation Sources## Vulnerability Details **File Location**: `SKILL.md`, lines 12-23 **Vulnerability Type**: Supply-chain exposure through mutable, unpinned dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # Install all skills from repo npx skills add https://github.com/barneyjm/camino-skills # Or install specific skills npx skills add https://github.com/barneyjm/camino-skills --skill context ``` ```bash npx clawhub@latest install context # or: pnpm dlx clawhub@latest install context # or: bunx clawhub@latest install context ``` ### Technical Analysis The documented installation commands resolve and execute third-party package-manager tooling without immutable version or integrity constraints. The `clawhub@latest` reference is explicitly mutable, the `skills` CLI has no exact version, and the GitHub source is not pinned to a reviewed commit hash or signed release. As a result, these commands may install or execute content that differs from the version reviewed during this audit. This does not establish that the current dependencies are malicious; it creates a supply-chain weakness whereby a future compromised or malicious release could affect users following the documented instructions. ### Attack Path 1. An attacker compromises a referenced npm publishing account, package, GitHub repository, or maintainer account. 2. The attacker publishes a malicious version of the CLI or modifies the repository's default branch. 3. A user follows an installation command from `SKILL.md`. 4. The package manager resolves the mutable or unpinned source controlled by the attacker. 5. Malicious installation logic or altered Skill content is downloaded and executed or installed with the invoking user's privileges. ### Impact Assessment Successful exploitation could permit arbitrary code execution under the account running the installation command. Depending on that account's permissions and environment, the malicious dependency could access user-readable files, environment ...[truncated 235 chars]
- Remediation
- ## Remediation Suggestions - Replace `@latest` with an exact, reviewed CLI version. - Pin the `skills` CLI to an exact version rather than relying on package-manager resolution of the current release. - Pin GitHub installation sources to a reviewed commit SHA or immutable signed release tag. - Publish and verify cryptographic integrity hashes or signatures for downloaded artifacts. - Use package-manager lockfiles where applicable and enable provenance or signature verification. - Review downloaded Skill files and lifecycle scripts before execution. - Document a controlled upgrade process that requires security review before changing pinned versions or commit hashes.