T08 · Insecure Dependencies
Warning
- Location
SKILL.md:66- Finding
Execution of an Unpinned npm Package Through npx
- Content
View full analysis
``` ### Technical Analysis The installation instructions invoke `clawhub@latest` through `npx`. This can download and execute whichever package version is associated with the mutable `latest` npm distribution tag at invocation time. The reviewed Skill therefore does not establish the exact code that users will execute. The package CLI and any applicable npm lifecycle scripts run with the privileges of the user invoking the command. If the npm package, publisher account, release process, or distribution tag is compromised, a malicious release could execute arbitrary commands before or during Skill installation. This command is not required for the Skill's primary search functionality. Installation should be a separate, explicitly approved operation using a reviewed and pinned dependency version. The pre-scan warning concerning a `curl | bash` remote-script pipeline was not confirmed. The documented `curl` pipelines pass API JSON to a local Python parser rather than to a shell. ### Attack Path 1. An attacker compromises the `clawhub` npm publisher account, package release process, or another component capable of changing the `latest` distribution tag. 2. The attacker publishes a malicious package version or points `latest` to a compromised release. 3. A user or agent follows the documented command and invokes `npx clawhub@latest install `. 4. `npx` retrieves the attacker-controlled release from the npm registry. 5. Package lifecycle behavior or CLI entry-point code executes locally with the invoking user's permissions. 6. The malicious package may access files and credentials available to that user, alter the user's environment, or execute additional payloads. ### Impact Assessment Successful exploitation permits a ...[truncated 498 chars]- Remediation
View remediation
install ``` 2. Verify the selected release's provenance and integrity before recommending it. Where feasible, install through a lockfile-backed project workflow that records the resolved version and integrity hash. 3. Require explicit user confirmation before downloading packages or installing Skills. Do not automatically execute this command as part of search behavior. 4. Run the installation under a non-privileged account and avoid environments containing unrelated secrets or broadly scoped credentials. 5. Periodically review pinned versions before upgrading. Version changes should be deliberate rather than inherited automatically through the mutable `latest` tag. 6. Document a manual installation method that allows users to inspect downloaded Skill contents before placing them in the Skills directory. ]]>