T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:29
- Finding
- Unpinned npm Package Execution via npx## Vulnerability Details **File Location**: `SKILL.md`, lines 29–34 and 54–75 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```bash # Search skills npx clawhub search "keyword" # Browse categories npx clawhub browse ``` Additional affected commands include: ```bash npx clawhub search "web search" npx clawhub search "weather" npx clawhub search "document" npx clawhub search "tavily" npx clawhub search "github" npx clawhub search "calendar" npx clawhub search --sort installs npx clawhub search --sort stars ``` ### Technical Analysis The skill repeatedly instructs users or agents to run `npx clawhub` without specifying an exact package version, integrity hash, lockfile, or verified local installation. If the package is not already available locally, `npx` can resolve, download, and execute the package from the configured npm registry. Because package resolution is not pinned to an audited artifact, the code executed at invocation time may differ from the code that existed when the skill was reviewed. A compromised maintainer account, malicious package release, registry compromise, or dependency-chain compromise could therefore turn a routine skill search into arbitrary local code execution. Package lifecycle scripts or the CLI entry point may execute with the operating-system privileges and environment of the invoking agent or user. ### Attack Path 1. An attacker compromises the `clawhub` npm package, one of its transitive dependencies, or its publication channel. 2. The attacker publishes a malicious release that contains harmful lifecycle or CLI code. 3. A user asks the agent to find or browse available skills. 4. Following `SKILL.md`, the agent executes an unversioned command such as `npx clawhub search "keyword"`. 5. `npx` resolves and downloads the attacker-controlled release from the configured registry. 6. The malicious package executes with the invoking process's permissions before or wh ...[truncated 630 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `clawhub` to an exact reviewed version rather than allowing unconstrained resolution: ```bash npx --package=clawhub@EXACT_VERSION clawhub search "keyword" ``` 2. Install dependencies through a committed lockfile and use deterministic installation commands, such as `npm ci`, where the surrounding project supports them. 3. Verify package provenance, publisher identity, signatures or attestations, and registry integrity before approving a version. 4. Record and validate package integrity hashes so that unexpected artifact changes cause installation to fail. 5. Prefer a preinstalled, locally verified executable over downloading executable code during each skill invocation. 6. Disable dependency lifecycle scripts where operationally practical, and review the package and its transitive dependencies before upgrades. 7. Run the command in a restricted environment with minimal filesystem access, no unnecessary credentials, and limited network permissions. 8. Establish an explicit update-review process instead of automatically consuming newly published releases.