T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:43
- Finding
- Unpinned External Installation Creates a Supply-Chain Execution Risk## Vulnerability Details **File Location**: `SKILL.md`, line 43 **Vulnerability Type**: Unpinned third-party package and Skill installation **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown - For public/ClawHub installs, you must run this first before any `event-tracking` command: `npx skills add jtrackingai/analytics-tracking-automation`. ``` ### Technical Analysis The Skill requires an `npx` command that may download and execute the currently published version of the `skills` package. Neither that package nor the `jtrackingai/analytics-tracking-automation` Skill source is pinned to an immutable version, commit, or integrity hash. This makes the effective installation behavior mutable after the audited bundle has been approved. A compromised package publisher, upstream account, registry entry, or Skill repository could therefore introduce behavior that was not present during this audit. Because the command is declared mandatory before any `event-tracking` command, users and agents are encouraged to execute the unreviewed upstream version automatically. No evidence was found that the current upstream dependencies are malicious. The finding concerns the unsafe dependency-resolution mechanism and its resulting supply-chain exposure. ### Attack Path 1. An attacker compromises an upstream package, publisher account, registry entry, or the referenced Skill source. 2. The attacker publishes a modified version containing malicious installation or runtime behavior. 3. An agent follows the mandatory instruction in `SKILL.md`. 4. `npx` resolves and retrieves the mutable upstream package, while the Skill installer retrieves the unpinned Skill revision. 5. The changed code executes or is installed under the invoking user's identity without being represented in this audited project. 6. The payload could access files, credentials, browser sessions, or network resources available to that user. ### Impact Assessment ...[truncated 713 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `npx` package to an exact reviewed version instead of resolving the latest release: ```bash npx --yes skills@<exact-version> add ... ``` 2. Pin the referenced Skill to an immutable commit, content digest, or signed release rather than a mutable repository reference. 3. Verify package integrity through a lockfile, registry integrity digest, or cryptographic signature. 4. Prefer bundling reviewed dependencies locally so normal execution does not retrieve mutable code. 5. Require explicit user confirmation before downloading or executing third-party installation content. 6. Perform installation in a least-privilege sandbox with restricted filesystem and network access. 7. Establish a controlled upgrade process in which new dependency versions are reviewed and their hashes updated deliberately. 8. Ensure artifact directories containing `credentials.json` are excluded from source control and inaccessible to unrelated local users.