T08 · Insecure Dependencies
Warning
- Location
- scripts/add_daily_pm_cron.sh:30
- Finding
- Unpinned Package Execution in a Recurring Agent Task<![CDATA[ ## Vulnerability Details **File Location**: `scripts/add_daily_pm_cron.sh`, lines 30–39 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```bash openclaw cron add \ --name "${NAME}" \ --agent "${AGENT_ID}" \ --cron "${CRON_EXPR}" \ --tz "${TZ}" \ --announce \ --description "Daily PM audit for repo: ${REPO_PATH}" \ --message "Run daily PM review for repo: ${REPO_PATH}\n\nProcess:\n1) Read docs/roadmap/ROADMAP.md\n2) Read docs/features/*/KANBAN.md\n3) Scan docs/pm/bugs/*.md and ensure each open bug is linked from a feature KANBAN\n4) gh pr list + check recent commits\n5) Ensure KANBAN + ROADMAP reflect reality\n6) Run lightweight checks (if applicable): cd apps/telegram && npx tsc --noEmit\n7) Post report: Done/In progress/Open bugs/Blocked/Risks/Next" ``` ### Technical Analysis The script embeds `npx tsc --noEmit` in the instructions of a persistent daily OpenClaw task. The command does not require a repository-local, lockfile-backed compiler and does not prohibit network package retrieval. If a trusted local `tsc` binary is unavailable, `npx` may resolve or download a package from the configured package registry, depending on the installed npm version and configuration. The requested executable name is also not version-pinned. Consequently, the code executed by the scheduled agent may differ from the code originally reviewed. The hardcoded `apps/telegram` path is unrelated to the generic repository-management purpose of the skill. This makes it more likely that the command will run in a repository without the expected local TypeScript dependency, increasing the chance of external package resolution or an unintended package being selected. ### Attack Path 1. A user invokes `add_daily_pm_cron.sh` and creates the daily OpenClaw task. 2. The task later runs under the configured agent identity. 3. The agent follows the embedded instruction and enters `apps/telegram`. 4. The tar ...[truncated 1215 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the repository-specific `apps/telegram` command from this generic skill. 2. Prefer a repository-defined, lockfile-backed script: ```bash npm run typecheck --if-present ``` 3. If direct compiler execution is required, install dependencies from a committed lockfile first and require offline resolution: ```bash npm ci --ignore-scripts npm exec --offline -- tsc --noEmit ``` 4. Verify that the expected executable exists locally before invoking it: ```bash test -x node_modules/.bin/tsc && node_modules/.bin/tsc --noEmit ``` 5. Do not permit `npx` to download missing packages during an unattended scheduled task. 6. Pin the approved TypeScript version in the repository manifest and lockfile, and review dependency integrity before enabling the recurring job. 7. Run the scheduled agent with least privilege, restricted credentials, and limited outbound network access to reduce the impact of dependency compromise. ]]>