T08 · Insecure Dependencies
- Location
SKILL.md:113- Finding
Unverified Installation of Mutable Third-Party Skills
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 113
Vulnerability Type: Unverified third-party dependency installation
Risk Level: MediumComplete Code Snippet:
markdown 安装：`clawhub install cn-ecommerce-compliance` / `clawhub install cn-advertising-compliance`Technical Analysis
The documentation recommends installing two third-party Skills by package name without specifying immutable versions, cryptographic hashes, signatures, trusted publisher identities, or reviewed source repositories. Because neither dependency is included in this project, its contents and behavior were outside the auditable artifact.
Name-only installation resolves mutable registry content at installation time. If a package publisher or registry is compromised, a package name is taken over, or a future release becomes malicious, the installed component could contain attacker-controlled instructions, scripts, or configuration. Actual execution and privilege scope depend on the package manager, the retrieved package, and the permissions granted to the Agent environment.
Attack Path
- An attacker gains control of one of the referenced package names, compromises its publisher account, or compromises the package distribution channel.
- The attacker publishes a malicious or modified release under the expected name.
- A user or Agent follows the documented name-only installation command.
- The package manager retrieves the mutable attacker-controlled release because no version, digest, signature, or source identity is enforced.
- When the installed Skill is loaded or invoked, its malicious instructions or code operate with whatever tools and permissions the host grants it.
Impact Assessment
The vulnerable project itself contains no executable payload, credential access, persistence mechanism, or data-exfiltration logic. The potential impact originates from the unverified dependency and therefore cannot be ...[truncated 444 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the optional installation commands unless the additional Skills are necessary.
- Pin each dependency to an immutable, reviewed version or content digest rather than installing by name alone.
- Document and verify the expected publisher identity and authoritative source repository.
- Require package signature and checksum validation before installation.
- Review the complete dependency contents, including scripts and transitive dependencies, before approval.
- Use an allowlisted internal mirror or trusted registry and enable publisher-account protections.
- Install and run third-party Skills with least privilege in an isolated environment, denying filesystem, network, secret, and command-execution access unless explicitly required.
- Re-audit dependencies whenever their pinned versions are updated.