T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:23
- Finding
- Unpinned External Skill Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 23-27 **Vulnerability Type**: Unverified and mutable external dependency **Risk Level**: Medium ### Vulnerable Code ```text Use the current OpenClawCash skill instead: https://clawhub.ai/macd2/open-claw-cash Do not continue setup with this legacy copy. Install the replacement skill from the URL above and follow its current instructions. ``` ### Technical Analysis The Skill instructs users or agents to install and follow a replacement Skill hosted at an external URL. The reference does not specify an immutable version, cryptographic digest, verified signature, or locally auditable copy. Consequently, the effective replacement content may change after this artifact has been reviewed. If the external account, hosting service, publication workflow, or referenced Skill is compromised, the replacement could supply instructions or executable components that were not covered by this audit. The reviewed file does not itself retrieve or execute remote code, and there is no evidence that the referenced replacement is malicious. The issue is an insecure supply-chain trust boundary caused by directing installation from a mutable, unpinned source. ### Attack Path 1. An attacker compromises the publisher account, external hosting platform, or replacement Skill's release process. 2. The attacker modifies the replacement Skill or its instructions while retaining the same URL. 3. A user or agent follows the directive in `SKILL.md` and installs the externally hosted replacement. 4. The replacement is loaded with the tools and permissions available to the agent. 5. Malicious replacement content may then misuse those capabilities without having been assessed as part of this audit. ### Impact Assessment The vulnerable artifact grants no privileges directly and contains no executable scripts. Potential impact depends on the replacement Skill and the permissions availabl ...[truncated 415 chars]
- Remediation
- ## Remediation Suggestions 1. Reference an immutable, explicitly approved release of the replacement Skill rather than a mutable landing-page URL. 2. Record and verify a cryptographic digest for the exact replacement package before installation. 3. Require publisher or package-signature verification through a trusted signing mechanism. 4. Vendor a reviewed copy into a controlled repository when feasible, preserving its provenance and license information. 5. Require a fresh security review whenever the replacement version or digest changes. 6. Prevent agents from automatically installing or following externally hosted Skill instructions without explicit user approval. 7. Install the replacement under least privilege, restricting credential access, filesystem access, network destinations, and executable tools to those strictly required.