T08 · Insecure Dependencies
Warning
- Location
SKILL.md:51- Finding
Unpinned Third-Party Package Execution Through npx
- Content
View full analysis
--no-input ``` From `SKILL.md:56`: ```powershell npx clawhub update --force --workdir --no-input ``` From `references/agent-guide.md:6-7`: ```text - `npx clawhub --cli-version` - `npx clawhub list --workdir --no-input` ``` From `references/agent-guide.md:27`: ```powershell npx clawhub update --all --workdir --no-input ``` From `references/agent-guide.md:32`: ```powershell npx clawhub update --force --workdir --no-input ``` ### Technical Analysis The skill repeatedly invokes `npx clawhub` without specifying an exact, reviewed package version. Depending on the local installation and npm configuration, `npx` can resolve and download the package from the configured npm registry before executing it. Because the package version, package integrity, and trusted registry are not pinned, the code executed by these commands can change after the skill has been reviewed. This creates a supply-chain exposure in both update operations and nominally read-only environment checks such as `--cli-version` and `list`. Exploitation would require control over, or malicious influence on, the package resolved as `clawhub`. Potential mechanisms include compromise of the legitimate package publisher, a compromised or attacker-controlled npm registry, malicious registry configuration, or publication of a malicious future release selected by the unpinned command. ### Attack Path 1. An attacker compromises the package or publishing account used for the `clawhub` package, or causes the victim to resolve packages through a malicious ...[truncated 1385 chars]- Remediation
View remediation
update --all --workdir --no-input ``` 2. Prefer a preinstalled and independently verified OpenClaw-native or ClawHub executable rather than downloading executable package content during each run. 3. Use a trusted registry explicitly and prevent user-controlled or project-controlled npm configuration from silently redirecting package resolution. 4. Manage the dependency through a lockfile that records the exact package version and integrity hash, then install it using a reproducible locked-dependency workflow. 5. Verify package provenance, signatures, checksums, and publisher identity before approving a new version. 6. Where compatible, disable unnecessary npm lifecycle scripts and execute updates from a restricted account with only the filesystem and network permissions required for the update. 7. Apply the same controls to detection commands. A command such as `npx clawhub --cli-version` can still retrieve and execute package code; it should not be treated as safe merely because its intended operation is read-only. 8. Separate package acquisition from execution: download and validate the approved artifact first, then execute only the validated local copy. ]]>