T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:47
- Finding
- Unpinned Third-Party npm Packages Executed with Broad Integration Privileges<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 47–48; related execution instructions at lines 94–100, 121–127, and 161 **Vulnerability Type**: Unpinned and dynamically resolved third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g openclaw-occ openclaw-occ install ``` Additional affected instructions: ```bash npx occ-verify # recent proofs (last 7 days) npx occ-verify --verbose # full detail per proof npx occ-verify --check # re-verify all proofs against notary npx occ-verify --tool bash # filter by tool name npx occ-verify --date 2026-02-27 # filter to a specific date npx occ-verify --session <id> # filter by session npx occ-verify --json # raw JSON output (for piping / scripting) ``` ```bash cd ~/.openclaw/extensions/openclaw-occ/notary-worker npx wrangler kv:namespace create OCC_PROOFS # Copy the output ID into wrangler.toml under [[kv_namespaces]] npx wrangler deploy ``` The document also identifies Wrangler authentication as a prerequisite: ```bash npx wrangler login ``` ### Technical Analysis The installation command globally installs `openclaw-occ` without pinning an exact package version or verifying package integrity. Consequently, the installed artifact is whichever release the npm registry resolves at execution time, rather than a version that can be tied reliably to the source reviewed during this audit. The `npx occ-verify` and `npx wrangler` instructions likewise do not specify exact versions. If an appropriate trusted local package is unavailable, `npx` may retrieve and execute a package from the npm registry. This creates a mutable remote execution boundary: registry contents, package ownership, and future releases can change independently of the audited `SKILL.md`. The risk is elevated because the installed OpenClaw plugin is documented as observing every agent tool action and integrating a ...[truncated 2291 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every executable npm dependency to an exact reviewed version, for example: ```bash npm install -g openclaw-occ@1.1.1 npm exec --package=occ-verify@<reviewed-version> -- occ-verify npm exec --package=wrangler@<reviewed-version> -- wrangler deploy ``` 2. Verify package integrity before execution: - Publish expected npm integrity hashes or signed provenance. - Document how users can compare the package checksum and provenance with a trusted release. - Tie each recommended package release to a specific reviewed source commit. 3. Prefer a project-local installation with a committed lockfile over global installation. Use deterministic installation commands such as `npm ci` where practical. 4. Disable or carefully review dependency installation scripts when they are unnecessary. Perform installation in a restricted environment before enabling the package as an OpenClaw extension. 5. Run OpenClaw, npm, and Wrangler under least-privileged accounts. Do not perform these commands as root or with unnecessary filesystem, secret, or network access. 6. Separate Wrangler authentication and deployment from unrelated package execution. Use narrowly scoped Cloudflare credentials and rotate them if an executed package is suspected of compromise. 7. Document a package update and review process so that version changes require renewed source inspection, integrity verification, and testing before deployment. ]]>