T08 · Insecure Dependencies
- Location
openclaw.json:4- Finding
Unpinned Third-Party Package Execution Through npx
- Content
View full analysis
Vulnerability Details
File Location:
openclaw.json:4-10
Vulnerability Type: Unpinned runtime dependency execution
Risk Level: MediumVulnerable Code
json "command": "npx", "args": [ "mcp-remote", "https://makepost.com/api/mcp/", "--header", "Authorization: Bearer ${MAKEPOST_API_KEY}" ]Technical Analysis
The Skill invokes
mcp-remotethroughnpxwithout specifying an exact package version. If the package is not already available locally,npxmay retrieve and execute the current registry release at runtime. The project contains no lockfile, integrity hash, vendored implementation, or other mechanism binding execution to the version that was reviewed.This creates a supply-chain vulnerability because the effective executable can change after the Skill has been audited. Compromise of the package, its maintainer account, or the relevant package-distribution path could introduce arbitrary code into subsequent Skill executions.
The API credential is also passed to the MCP client as part of its arguments. Therefore, malicious package code executing in that process context could potentially obtain the
MAKEPOST_API_KEYand access other resources available to the OpenClaw process.Attack Path
- An attacker compromises the
mcp-remotepackage, its publisher account, or its dependency chain. - The attacker publishes a malicious release under the package name used by the Skill.
- A user installs or starts the Skill in an environment where the audited package version is not locally pinned.
npxresolves, downloads, and executes the malicious package release.- The malicious code runs with the operating-system privileges and environment access of the OpenClaw process.
- It may read or intercept
MAKEPOST_API_KEY, communicate with attacker-controlled infrastructure, or access files and services permitted to that process.
Impact Assessment
Successful ex ...[truncated 556 chars]
- An attacker compromises the
- Remediation
View remediation
Remediation Suggestions
- Pin
mcp-remoteto an exact, reviewed version rather than resolving an unspecified release. - Install dependencies during a controlled build or installation phase using a lockfile with registry integrity metadata.
- Invoke a locally installed, verified executable at runtime, or use
npx --no-installso execution fails rather than downloading an unreviewed package. - Enable automated dependency monitoring while requiring review and testing before version updates.
- Run the MCP client under least privilege with restricted filesystem and network access.
- Expose only the required API credential to the child process and avoid placing unrelated secrets in its environment.
- Rotate
MAKEPOST_API_KEYimmediately if dependency compromise is suspected, and review MakePost activity for unauthorized publishing, scheduling, webhook, or account operations.
- Pin