T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:35
- Finding
- Unpinned npm Package Execution and Global Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:35`, `SKILL.md:47`, and `SKILL.md:70` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```markdown npx clawvet scan ./skill-folder/ --format json ``` ```markdown For many skills at once, run `npx clawvet audit` and report the grade breakdown. ``` ```bash npm install -g clawvet clawvet gate --print-config ``` ### Technical Analysis The Skill's primary workflow instructs the Agent to execute `clawvet` through `npx` without specifying an exact package version. It also recommends globally installing the latest available version of the package. Because these commands resolve a mutable package version from the npm registry, the code that ultimately executes can differ from the version reviewed when this Skill was published. Although `SKILL.md` discusses npm provenance and suggests pinning when fixed detection rules are desired, it does not make version pinning and verification prerequisites for execution. Running the package through `npx` permits downloaded package code to execute with the privileges and environment of the invoking user. A global installation additionally exposes the user to persistent changes in the globally installed tool and increases the duration for which a compromised release remains available. This exceeds the minimum privileges required for static scanning because a locally pinned, integrity-verified dependency could provide the same functionality without automatically trusting the current registry release. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution process, or a future `clawvet` release. 2. The attacker publishes a malicious version under the legitimate package name. 3. An Agent follows `SKILL.md` and runs the unpinned `npx clawvet ...` command or `npm install -g clawvet`. 4. npm retrieves the attacker-controlled release from the registry. 5. Package installati ...[truncated 1171 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every execution to an exact reviewed version: ```bash npx --yes clawvet@0.12.4 scan ./skill-folder/ --format json ``` 2. Prefer installing the dependency locally through a lockfile rather than executing the latest registry release dynamically: ```bash npm install --save-exact clawvet@0.12.4 npm exec -- clawvet scan ./skill-folder/ --format json ``` 3. Verify npm provenance, signatures, package integrity, and publisher identity before installation or execution. Make these checks mandatory rather than advisory. 4. Review package installation scripts before use and disable lifecycle scripts during installation where compatible with the package: ```bash npm install --ignore-scripts --save-exact clawvet@0.12.4 ``` 5. Run the scanner in a sandbox with: - Read-only access to the directory being scanned. - No access to unrelated home-directory files. - No unnecessary environment variables or credentials. - Network access disabled for static local scans. 6. Avoid global installation unless the persistent gate is explicitly requested. If global installation is necessary, pin and verify the version, document the persistent configuration change, and provide the existing removal procedure. 7. For optional semantic scanning, obtain explicit user consent and document exactly which source files, metadata, and prompts are transmitted to the external service. Pass only the minimum necessary credential and content. ]]>