T08 · Insecure Dependencies
Warning
- Location
- _meta.json:9
- Finding
- Unpinned Native Mouse-Control Dependency## Vulnerability Details **File Location**: `_meta.json:9-12`; also referenced in `SKILL.md:11-12` and `SKILL.md:27-30` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium **Vulnerable Code**: ```json "requires": { "skills": ["win-mouse-native"], "bins": ["powershell"] } ``` The installation documentation additionally instructs users to retrieve the dependency by name: ```bash clawhub install win-mouse-native ``` ### Technical Analysis The package depends on `win-mouse-native` without specifying an immutable version, cryptographic digest, verified publisher, or trusted source. Consequently, the dependency resolved during installation may differ from the version reviewed or tested by the package author. This dependency is security-sensitive because its documented purpose is native mouse control. A compromised, replaced, or otherwise malicious release could perform arbitrary mouse movements and clicks in the current desktop session. The supplied artifact does not contain the dependency implementation, so its behavior and integrity cannot be independently verified as part of this audit. ### Attack Path 1. An attacker compromises the dependency publisher, distribution channel, or package name. 2. The attacker publishes a modified release under the `win-mouse-native` dependency name. 3. A user follows the documented `clawhub install win-mouse-native` command. 4. The package manager resolves and installs the attacker-controlled release because no immutable version or digest is required. 5. When invoked, the dependency performs unauthorized desktop interactions under the user's active session. ### Impact Assessment Successful exploitation would grant the malicious dependency the ability to control mouse input with the privileges of the current interactive user. Depending on the visible applications and desktop state, it could click unintended controls, approve prompts that do no ...[truncated 306 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `win-mouse-native` to a specific, audited version. 2. Require and verify a cryptographic digest or signed package manifest before installation. 3. Identify the expected publisher and trusted registry explicitly. 4. Document a reproducible dependency verification procedure. 5. Audit the exact dependency release before publishing this skill. 6. Restrict dependency use to the minimum required operations and provide a non-interactive or confirmation-gated mode where possible. 7. Fail closed if the installed dependency version or digest does not match the approved value.