T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:6
- Finding
- Automatic Installation of Unpinned Third-Party Skills<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:6-11` **Corroborating Location**: `README.md:130-135` **Vulnerability Type**: Unpinned automatic third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```yaml "openclaw": { "requires": { "skills": ["mx-search", "mx-data", "mx-select-stock", "stock-monitor-skill"], "action": "auto-install" }, ``` The installation documentation also uses unversioned dependency identifiers: ```bash clawhub install mx-data mx-search mx-select-stock stock-monitor-skill ``` ### Technical Analysis The Skill declares four external Skills and instructs the OpenClaw environment to install them automatically. None of these dependencies is pinned to a reviewed version or protected by an integrity hash. The configuration also provides no publisher verification, trusted registry restriction, or explicit approval step. Consequently, the effective behavior of this package is not limited to the source code included in the audited project. It also depends on whichever versions of these external Skills the package registry resolves at installation time. A dependency could change after this audit, or its distribution account could be compromised, without requiring any modification to the reviewed project. This creates a supply-chain risk. Because the dependencies provide search, financial-data, stock-selection, and monitoring functionality, they may receive market queries and operate in an environment containing a configured financial-data API key. The exact privileges available to a dependency depend on the OpenClaw runtime, but an affected dependency could potentially misuse any network, tool, environment-variable, or Agent capabilities granted to it. ### Attack Path 1. An attacker compromises the registry account or distribution channel for one of the declared Skills, or publishes an unsafe replacement under a dependency identifier accepted by the resolver. 2. ...[truncated 1532 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove automatic dependency installation and require explicit user approval before installing each external Skill. 2. Pin every dependency to an exact, security-reviewed version rather than resolving the latest available release. 3. Require cryptographic integrity hashes or signed package metadata and reject dependencies that fail verification. 4. Restrict dependency resolution to a trusted registry and verify the publisher identity for every package. 5. Document the permissions, network access, environment variables, and tools required by each dependency. 6. Grant dependencies only the minimum capabilities necessary for their declared functions. 7. Do not expose the financial-data API key globally. Provide it only to the specific component that requires it, preferably through scoped and revocable credentials. 8. Review dependency updates before deployment and use an allowlist of approved package versions and hashes. 9. Record installed versions in a lock file or equivalent manifest so installations are reproducible. 10. Add runtime monitoring for unexpected network destinations, credential access, filesystem access, and tool invocations by third-party Skills. ]]>