T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:15
- Finding
- Unpinned Third-Party CLI and Unattended Workflow Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 15-18 and 41-46 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```yaml install: - id: node kind: node package: "@anygen/cli" ``` ```markdown If the `anygen-workflow-generate` skill is not available, install it first: ```bash anygen skill install --platform <openclaw|claude-code> -y ``` ``` ### Technical Analysis The skill depends on the third-party `@anygen/cli` package without specifying an exact version, integrity hash, lockfile, or other immutable reference. As a result, the content installed in the future may differ from the content reviewed during this audit. The fallback instruction also installs an externally supplied workflow skill using the `-y` option, which suppresses interactive confirmation. No version, checksum, trusted commit, or reviewed artifact is specified for that workflow. This creates a supply-chain trust boundary in which mutable upstream content can introduce new executable behavior or agent instructions after the original skill has been audited. The CLI is used for authentication and server-side diagram generation. A compromised dependency could therefore potentially access the `ANYGEN_API_KEY`, diagram inputs, process environment, and any local resources available to the CLI under the invoking user's permissions. ### Attack Path 1. An attacker compromises the upstream npm package, its publisher account, the package distribution channel, or the remotely installed workflow skill. 2. The attacker publishes malicious content under the same mutable package or skill identifier. 3. A user or agent installs `@anygen/cli` without a pinned version, or executes the unattended `anygen skill install ... -y` command. 4. The compromised CLI or workflow is installed instead of the previously reviewed implementation. 5. When invoked, the malicious component executes o ...[truncated 1027 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@anygen/cli` to an exact reviewed version rather than resolving a mutable latest release. 2. Use a lockfile and verify package integrity with trusted cryptographic hashes. 3. Pin the workflow skill to a specific immutable version, release digest, or audited commit. 4. Remove the unattended `-y` installation option, or require explicit informed user approval before downloading and installing additional skill content. 5. Audit the `anygen-workflow-generate` skill separately before installation or bundle a reviewed copy with the package. 6. Run the CLI with least privilege and restrict its filesystem, environment-variable, tool, and network access where supported. 7. Provide `ANYGEN_API_KEY` only to the process that requires it, use a narrowly scoped credential, and rotate it if dependency compromise is suspected. 8. Clearly document that diagram input is processed by an external service and instruct users not to submit secrets or unnecessary sensitive information.