T08 · Insecure Dependencies
Error
- Location
- SKILL.md:23
- Finding
- Unpinned External npm Package Is Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md:23-26, 51`; `EXAMPLES.md:3-7, 10-14, 16-19, 21-25, 45-49, 56-60` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code `SKILL.md:23-26`: ```bash npx -y create-opc-wiki@latest <path> --yes --agents=openclaw,claude,codex,cursor ``` `SKILL.md:51`: ```text Run `npm install && npm start` from the `mcp/` directory. ``` `EXAMPLES.md:3-7`: ```bash npx -y create-opc-wiki@latest ~/wiki --yes \ --agents=openclaw,claude,codex,cursor,hermes,vscode ``` `EXAMPLES.md:10-14`: ```bash npx -y create-opc-wiki@latest /tmp/quick-wiki --yes \ --agents=claude --no-mcp --no-site --no-recipes --no-git ``` `EXAMPLES.md:16-19`: ```bash npx -y create-opc-wiki@latest ~/research --yes \ --domains=ai,bio,papers,methodology --agents=claude ``` `EXAMPLES.md:21-25`: ```bash npx -y create-opc-wiki@latest /tmp/wiki --yes --json --no-git \ | jq '{ok, files, dirs, target}' ``` `EXAMPLES.md:45-49`: ```bash cd ~/wiki/mcp npm install npm start ``` `EXAMPLES.md:56-60`: ```bash cd ~/wiki/site npm install npm run build ``` ### Technical Analysis The documented `npx -y create-opc-wiki@latest` command downloads and immediately executes the package version currently associated with the mutable `latest` npm distribution tag. Neither an exact version nor an integrity digest is specified. The `-y` option also suppresses the normal installation confirmation, reducing the opportunity for users or agents to inspect what will run. Consequently, the code executed by this skill can change after the reviewed Markdown files have been published. The external implementation is not included in the audited artifact, so its behavior and the documentation's claims concerning telemetry, privacy gates, generated rules, and local-only processing cannot be verified here. The generated pro ...[truncated 2013 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version, for example `create-opc-wiki@X.Y.Z`. 2. Verify the downloaded package using an approved integrity digest or trusted internal artifact registry. Record the expected package provenance and checksum in the installation documentation. 3. Remove `-y` from recommended interactive commands so users receive an installation prompt and can review the selected package and version. 4. Vendor the required implementation into the audited project, or provide reproducible build instructions and signed release artifacts so behavior can be reviewed without trusting a mutable remote tag. 5. Commit lockfiles for the generated MCP and site projects. Use `npm ci` rather than unconstrained `npm install` to reproduce the audited dependency graph. 6. Pin direct and transitive dependencies, enable npm provenance verification where available, and continuously scan lockfiles for compromised or vulnerable packages. 7. Disable package lifecycle scripts during dependency installation where they are unnecessary, such as with `npm ci --ignore-scripts`, and explicitly run only reviewed build steps afterward. 8. Execute the scaffolder in a restricted container or sandbox with minimal filesystem access, no unnecessary credentials, and no elevated privileges. 9. Require users to inspect generated agent rules, skills, MCP server code, and site scripts before opening the vault in an AI agent or starting generated services.