T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:14
- Finding
- Unpinned Package Execution and Inconsistent Skill Identifiers<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14`, `README.md:20`, and `package.json:2` **Vulnerability Type**: Unpinned third-party package execution and package identifier ambiguity **Risk Level**: Medium ### Vulnerable Code `SKILL.md:14`: ```bash npx clawhub install system-info-skill ``` `README.md:20`: ```bash npx clawhub install system-info ``` `package.json:2`: ```json "name": "system-info", ``` ### Technical Analysis The documented installation procedure invokes `clawhub` through `npx` without specifying an exact package version or integrity value. When the package is unavailable locally, `npx` can retrieve and execute the version currently resolved by the configured npm registry. Consequently, the code executed during installation is not fixed to the version that was reviewed. The project also uses inconsistent Skill identifiers. `SKILL.md` instructs users to install `system-info-skill`, while `README.md` and `package.json` identify the project as `system-info`. If both identifiers exist or an unintended party controls one of them, users following different documentation could install different Skill packages. This is a supply-chain weakness rather than evidence that the current local script is malicious. Exploitation depends on compromise, replacement, dependency confusion, or mistaken resolution of the external CLI or referenced Skill package. ### Attack Path 1. An attacker publishes or compromises a package that can be resolved as the unpinned `clawhub` CLI, or controls the unintended Skill identifier created by the naming inconsistency. 2. A user follows the installation command from `SKILL.md` or `README.md`. 3. `npx` resolves and downloads the current registry version of `clawhub`, rather than a reviewed and pinned version. 4. The downloaded CLI executes with the privileges of the user running the installation command. 5. The inconsistent identifier may cause the CLI to retrieve and install a different Skill package ...[truncated 993 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the installation CLI to a reviewed version: ```bash npx --yes clawhub@<reviewed-version> install system-info ``` 2. Where supported, pin the Skill package to an exact immutable version or verified digest rather than installing the latest release. 3. Standardize the Skill identifier across all project files. Choose one canonical identifier, such as `system-info`, and update `SKILL.md`, `README.md`, and package metadata accordingly. 4. Document the expected registry and publisher identity so users can verify that package resolution uses a trusted source. 5. Publish checksums, signatures, or provenance attestations for distributed Skill artifacts and require verification before installation. 6. Recommend installation from a lockfile-backed or otherwise reproducible environment. In sensitive environments, download and inspect the CLI package before executing it rather than allowing `npx` to fetch and run an unreviewed current version. 7. Run installation with a non-administrative account and restrict CI tokens, filesystem permissions, and environment secrets available to the installation process. ]]>