T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:142
- Finding
- Unpinned npx Execution May Retrieve and Execute Unreviewed Packages## Vulnerability Details **File Location**: `SKILL.md:1-5, 142-148`; corroborated by `README.md:42-44` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```yaml --- name: blog-hexo description: Draft and publish Hexo posts end-to-end (front matter + SEO polish + deploy) metadata: { "openclaw": { "requires": { "bins": ["node", "npm", "npx", "hexo"] } } } --- ``` ```markdown ## Hexo Command Workflow Whenever you modify or create a post in the user-specified blog repository, confirm the path (ask if unsure) and run: 1. `npx hexo clean` 2. `npx hexo generate` 3. `npx hexo deploy` These commands rebuild the site and push to the configured remote using the user’s git credentials. ``` The README repeats the executable workflow: ```bash npx hexo clean npx hexo generate npx hexo deploy ``` ### Technical Analysis The skill repeatedly directs the agent to invoke `npx hexo` without specifying a package version, requiring a lockfile-backed local dependency, or prohibiting package downloads. The audited project contains only documentation and does not include a package manifest or lockfile that establishes the exact Hexo package and transitive dependency versions to execute. Depending on the installed npm/npx version and local environment, `npx` can resolve and download a package when the requested executable is not already available locally. Any downloaded package and its dependency code may execute with the privileges of the agent process. This creates a supply-chain boundary in which the code ultimately executed can differ from the code reviewed during this audit. This finding does not establish that the genuine Hexo package is malicious. The vulnerability is the workflow's failure to ensure that only a reviewed, locally installed, version-locked executable is used. ### Attack Path 1. The user asks the agent to create, modify, preview, or publi ...[truncated 1308 chars]
- Remediation
- ## Remediation Suggestions 1. Add Hexo and all required plugins to the target blog repository's `package.json` using exact or appropriately constrained versions. 2. Commit and review the package lockfile, and use `npm ci` to reproduce the locked dependency graph. 3. Replace download-capable execution with a local-only invocation, such as: ```bash npm exec --offline -- hexo clean npm exec --offline -- hexo generate npm exec --offline -- hexo deploy ``` Alternatively, use a supported `npx --no-install` equivalent where applicable. 4. Fail safely if the expected local executable is unavailable rather than retrieving a package automatically. 5. Pin the Node.js and npm versions used by the workflow. 6. Review Hexo plugins and deployer packages because they execute with the same access as Hexo itself. 7. Run generation in a restricted environment without deployment credentials. Expose credentials only to the separately authorized deployment step.