T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:58
- Finding
- Unpinned Third-Party Security Plugin Installed and Executed with Broad Capabilities## Vulnerability Details **File Location**: `SKILL.md`, lines 58–87 **Vulnerability Type**: Unpinned third-party dependency installation and update **Risk Level**: Medium ### Vulnerable Code ```markdown ## Step 2: Fresh install ``` exec { "command": "openclaw plugins install clawhub:openclaw-plugin-vt-sentinel" } ``` This downloads the ClawHub package, registers the plugin, and loads skills and hooks automatically. No manual configuration needed. Go to Step 4. ## Step 3: Upgrade in place ``` exec { "command": "openclaw plugins update openclaw-plugin-vt-sentinel" } ``` The OpenClaw CLI handles the upgrade atomically: it fetches the latest version, replaces the extension directory, and updates `plugins.installs` metadata. User config in `plugins.entries` and state files under `<OPENCLAW_STATE_DIR>` are preserved. If the CLI reports "already at latest version", tell the user VT Sentinel is up to date and skip to Step 5 (verify only). If the update is blocked (for example by a corrupted install), fall back to a clean reinstall using only official subcommands: ``` exec { "command": "openclaw plugins uninstall openclaw-plugin-vt-sentinel --force" } exec { "command": "openclaw plugins install clawhub:openclaw-plugin-vt-sentinel" } ``` ``` ### Technical Analysis The Skill installs or updates `openclaw-plugin-vt-sentinel` using a mutable package identifier. It does not specify an audited version, immutable package digest, or signature requirement. Although the documentation describes the package as verified and suggests an inspection command elsewhere, inspection is optional rather than a mandatory pre-installation control. The package is especially security-sensitive because installation automatically registers its hooks and skills. The documented plugin behavior includes automatic file scanning, file and command execution blocking, network registration with VirusTotal's VTAI service, and ...[truncated 2245 chars]
- Remediation
- ## Remediation Suggestions 1. Pin installation to a specifically audited plugin version rather than resolving the latest mutable release. 2. Require verification against an immutable cryptographic digest or trusted package signature before installation or update. 3. Make `openclaw plugins inspect clawhub:openclaw-plugin-vt-sentinel` a mandatory step rather than an optional recommendation. 4. Before approval, show the user the resolved version, publisher identity, package digest, requested permissions, registered hooks, filesystem scope, and network destinations. 5. Require separate explicit consent before activating automatic file monitoring, network registration, or file-upload functionality. 6. Verify updates before replacing the installed extension, and retain a known-good version for rollback. 7. Document and constrain the plugin's outbound endpoints, file-access boundaries, and upload policy. 8. Prefer a least-privilege execution model that isolates the plugin from unrelated files, credentials, processes, and OpenClaw state.