T08 · Insecure Dependencies
Error
- Location
- SKILL.md:6
- Finding
- Unpinned Dependency Execution and Unauditable External Components## Vulnerability Details **File Location**: `SKILL.md`, lines 6, 23, 134–195, and 243–248 **Vulnerability Type**: Unpinned third-party dependency and execution of external components outside the audited project **Risk Level**: High ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"🧀","requires":{"bins":["npx"]}}} ``` ```bash npx tsx scripts/cheese-cli.ts chat read <request_address> --watch ``` ```bash cd ~/clawd/cheese npx tsx scripts/cheese-cli.ts <command> [options] ``` ```typescript const client = new CHEESEClient({ wallet: { privateKey: process.env.CHEESE_PRIVATE_KEY as `0x${string}` }, rpcUrl: process.env.CHEESE_RPC_URL, }); ``` ```bash cd ~/clawd/cheese/infra/waku docker compose up -d ``` ### Technical Analysis The Skill repeatedly invokes `npx tsx` without pinning the `tsx` package to a reviewed version or supplying a lockfile or integrity hash. If `tsx` is unavailable locally, `npx` may retrieve and execute a package from the npm registry. Consequently, the code executed at runtime may differ from what was reviewed. The invoked CLI, SDK, and Docker Compose files are referenced under `~/clawd/cheese`, but they are not included in the audited project. The audited package contains only `SKILL.md`. Their behavior therefore cannot be verified even though the instructions expect these external components to: - Access `CHEESE_PRIVATE_KEY`. - Connect to external RPC and Waku services. - Sign and submit blockchain transactions. - Move escrow and collateral funds. - Start persistent Docker containers. - Process marketplace communications. This creates a supply-chain trust boundary around components with direct access to sensitive credentials and financial operations. ### Attack Path 1. An attacker compromises the unpinned npm dependency, substitutes the external `~/clawd/cheese` checkout, or alters an unpinned Docker image used by the referenced Compose configuration. 2. A user follows the Skill instructions and runs `npx tsx scripts/c ...[truncated 1240 chars]
- Remediation
- ## Remediation Suggestions 1. Include the complete CLI, SDK, dependency manifests, lockfiles, and Docker Compose configuration in the Skill package so all executed components can be audited. 2. Pin `tsx` and every other npm dependency to exact reviewed versions. Commit a lockfile and enforce integrity verification during installation. 3. Avoid runtime package retrieval. Install dependencies through a controlled build process and invoke a pinned local binary, preferably with offline execution enabled. 4. Pin container images by immutable digest rather than mutable tags, and document their provenance. 5. Pin the external repository to a verified commit and validate its cryptographic checksum before execution. 6. Isolate wallet signing from the CLI. Prefer a hardware wallet, restricted signer, or approval interface instead of exposing a raw private key to general-purpose scripts. 7. Require explicit user confirmation before every transaction, displaying the chain ID, contract address, method, recipient, token, amount, and calldata summary. 8. Run the CLI and containers with least privilege, restricted filesystem mounts, a minimal environment, and narrowly scoped network access. 9. Never pass the wallet key to Waku or unrelated container services. Separate chat and transaction-signing processes and provide each only the credentials it strictly requires.