T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned Third-Party Skills Are Installed Automatically## Vulnerability Details **File Location**: `SKILL.md`, lines 8–13 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Complete Code Snippet ```yaml metadata: { "openclaw": { "requires": { "skills": ["mx-data", "mx-search", "mx-select-stock", "mx-selfselect", "stock-monitor-skill"], "action": "auto-install" }, ``` The corresponding installation documentation in `README.md`, lines 137–140, also omits versions and integrity constraints: ```bash clawhub install mx-data mx-search mx-select-stock mx-selfselect stock-monitor-skill ``` ### Technical Analysis The Skill declares five third-party dependencies and instructs OpenClaw to install them automatically. None of these dependencies is pinned to a reviewed immutable version or content digest. Consequently, the code and instructions loaded at installation time can differ from those reviewed during this audit. The effective behavior depends on mutable registry entries and the ongoing security of each dependency publisher and distribution channel. This is a supply-chain weakness rather than evidence that the named dependencies are currently malicious. Exploitation requires one of those dependency sources, publisher accounts, or package-resolution mechanisms to become compromised or attacker-controlled. ### Attack Path 1. An attacker compromises a named dependency's publisher account, registry entry, or distribution channel. 2. The attacker publishes a malicious release under the legitimate dependency name. 3. A user installs or loads this Skill. 4. The `auto-install` action resolves and installs the mutable current release without explicit user approval or integrity verification. 5. OpenClaw loads or invokes the malicious dependency. 6. The dependency executes attacker-controlled instructions or code within the permissions available to the Agent runtime. ### Impact Assessment Successful exploitation could provide t ...[truncated 620 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every dependency to a reviewed, immutable version rather than resolving an unconstrained latest release. 2. Where supported, lock dependencies by cryptographic content digest and verify signatures or checksums before activation. 3. Replace automatic installation with an explicit user-confirmed installation step. 4. Maintain a lock file or equivalent manifest recording exact versions, digests, publishers, and trusted sources. 5. Audit each dependency and its transitive dependencies before approving upgrades. 6. Restrict installed dependencies through least-privilege permissions, including network destinations, environment-variable access, filesystem access, and available Agent tools. 7. Configure update monitoring and require security review whenever a pinned dependency changes. 8. Document the reviewed dependency versions in both `SKILL.md` and `README.md` so the manual and automatic installation paths use identical constraints.