T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:61
- Finding
- Unpinned Runtime Package Execution via npx## Vulnerability Details **File Location**: `SKILL.md`, line 61 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable Code**: ```bash npx clawhub@latest install <skill-slug> ``` ### Technical Analysis The documented installation command instructs the agent to retrieve and execute the mutable `latest` release of the `clawhub` npm package at runtime. Neither an exact package version nor a cryptographic integrity value is specified. Consequently, the code executed by this command may differ from the code available when the skill was audited. Because `npx` can download and execute npm package entry points, compromise of the package, its publishing account, or its dependency chain could result in arbitrary code execution under the identity running the agent. The command also installs a selected community skill, extending the supply-chain trust boundary further. The skill recommends inspection and warns that community skills are not audited, but these procedural safeguards do not provide reproducibility or integrity verification for the CLI package executed through `npx`. ### Attack Path 1. An attacker compromises the `clawhub` npm package, a maintainer account, or a transitive dependency and causes a malicious version to become the `latest` release. 2. A user asks the agent to install a skill. 3. The agent follows the documented command and executes `npx clawhub@latest install <skill-slug>`. 4. `npx` retrieves the mutable package release and executes its package entry point. 5. The malicious package runs with the permissions and environmental access of the agent process. 6. It may access available workspace data, environment variables, or user-accessible files and may install additional unsafe content. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the account running the agent. The affected scope may include the current workspace, user-readable or u ...[truncated 369 chars]
- Remediation
- ## Remediation Suggestions - Replace `@latest` with an exact, reviewed package version, for example `npx clawhub@X.Y.Z`. - Prefer a trusted, preinstalled CLI managed through a lockfile or controlled package-management process. - Verify npm package provenance and cryptographic integrity before execution. - Review and pin relevant transitive dependencies where the packaging workflow permits it. - Require explicit user confirmation before downloading and executing a package or installing a community skill. - Preserve the existing inspection-first workflow, but treat source inspection and malware reports as supplementary controls rather than substitutes for version and integrity pinning. - Test upgrades in an isolated environment before changing the approved package version.