T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned External Skill Installation Creates Supply-Chain Risk<.** Install amigo instead: > ```bash > clawhub install amigo > ``` ``` Additional installation instructions: ```markdown ```bash clawhub install amigo # umbrella (includes setup guides + safety) clawhub install open-thoughts # exploration only clawhub install social-graph # social intelligence only ``` ``` ### Technical Analysis The Skill directs users to install three external ClawHub packages without specifying immutable versions or integrity hashes. None of those external packages is included in the audited project, so their contents and behavior could not be verified. Because the commands resolve packages from an external registry at installation time, the installed content may differ from the content that existed when this redirecting Skill was reviewed. A compromised maintainer account, registry compromise, malicious package update, or package-name reassignment could cause users to retrieve unreviewed instructions or executable components. The file itself contains no local executable code and does not automatically run these commands. Exploitation therefore requires a user or Agent to follow the documented installation instructions. ### Attack Path 1. An attacker compromises the external package, its publisher account, or the package registry. 2. The attacker publishes a malicious release under `amigo`, `open-thoughts`, or `social-graph`. 3. A user follows an unversioned `clawhub install` command from `SKILL.md`. 4. The package manager retrieves the current, attacker-controlled package. 5. Malicious instructions or code in the installed Skill execute when it is loaded or invoked, subject to the permissions available to the Agent and its tools. ### Impact Assessment The vuln ...[truncated 542 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every external Skill to a reviewed, immutable version rather than resolving the latest release by name. 2. Where supported, specify and verify a cryptographic integrity hash or signed package identity. 3. Publish the expected publisher identity, version, source repository, and checksum alongside each installation command. 4. Review the complete dependency contents before recommending installation, including scripts, hooks, nested dependencies, and requested permissions. 5. Require explicit user confirmation before downloading or installing external Skills. 6. Prefer vendoring reviewed dependency content when reproducible package pinning and integrity verification are unavailable. 7. Establish a recurring process to reassess pinned versions before updating them. ]]>