T08 · Insecure Dependencies
- Location
SKILL.md:6- Finding
Unpinned Dependency Execution and Unauditable External Components
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 6, 23, 134–195, and 243–248
Vulnerability Type: Unpinned third-party dependency and execution of external components outside the audited project
Risk Level: HighVulnerable Code
yaml metadata: {"clawdbot":{"emoji":"🧀","requires":{"bins":["npx"]}}}bash npx tsx scripts/cheese-cli.ts chat read <request_address> --watchbash cd ~/clawd/cheese npx tsx scripts/cheese-cli.ts <command> [options]typescript const client = new CHEESEClient({ wallet: { privateKey: process.env.CHEESE_PRIVATE_KEY as `0x${string}` }, rpcUrl: process.env.CHEESE_RPC_URL, });bash cd ~/clawd/cheese/infra/waku docker compose up -dTechnical Analysis
The Skill repeatedly invokes
npx tsxwithout pinning thetsxpackage to a reviewed version or supplying a lockfile or integrity hash. Iftsxis unavailable locally,npxmay retrieve and execute a package from the npm registry. Consequently, the code executed at runtime may differ from what was reviewed.The invoked CLI, SDK, and Docker Compose files are referenced under
~/clawd/cheese, but they are not included in the audited project. The audited package contains onlySKILL.md. Their behavior therefore cannot be verified even though the instructions expect these external components to:- Access
CHEESE_PRIVATE_KEY. - Connect to external RPC and Waku services.
- Sign and submit blockchain transactions.
- Move escrow and collateral funds.
- Start persistent Docker containers.
- Process marketplace communications.
This creates a supply-chain trust boundary around components with direct access to sensitive credentials and financial operations.
Attack Path
- An attacker compromises the unpinned npm dependency, substitutes the external
~/clawd/cheesecheckout, or alters an unpinned Docker image used by the referenced Compose configuration. - A user follows the Skill instructions and runs `npx tsx scripts/c ...[truncated 1240 chars]
- Access
- Remediation
View remediation
Remediation Suggestions
- Include the complete CLI, SDK, dependency manifests, lockfiles, and Docker Compose configuration in the Skill package so all executed components can be audited.
- Pin
tsxand every other npm dependency to exact reviewed versions. Commit a lockfile and enforce integrity verification during installation. - Avoid runtime package retrieval. Install dependencies through a controlled build process and invoke a pinned local binary, preferably with offline execution enabled.
- Pin container images by immutable digest rather than mutable tags, and document their provenance.
- Pin the external repository to a verified commit and validate its cryptographic checksum before execution.
- Isolate wallet signing from the CLI. Prefer a hardware wallet, restricted signer, or approval interface instead of exposing a raw private key to general-purpose scripts.
- Require explicit user confirmation before every transaction, displaying the chain ID, contract address, method, recipient, token, amount, and calldata summary.
- Run the CLI and containers with least privilege, restricted filesystem mounts, a minimal environment, and narrowly scoped network access.
- Never pass the wallet key to Waku or unrelated container services. Separate chat and transaction-signing processes and provide each only the credentials it strictly requires.