T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:77
- Finding
- Unpinned External Discord Skill Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:77-80`; `reference.md:137-142` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:77-80`: ```shell clawhub install steipete/discord openclaw add @steipete/discord ``` `reference.md:137-142`: ```shell clawhub install steipete/discord openclaw add @steipete/discord ``` ### Technical Analysis The documentation instructs users to install an external Discord Skill by a mutable package name without specifying an immutable version, commit hash, checksum, or cryptographic signature. Consequently, the content installed in the future may differ from the content reviewed when this project was audited. The project describes the dependency as an official or community Discord Skill, but it does not provide a locally verifiable trust mechanism. If the publishing account, package registry, package namespace, or a later release is compromised, the installation commands could retrieve attacker-controlled content. This is a supply-chain weakness rather than evidence that the currently referenced dependency is malicious. Exploitation depends on compromise or unauthorized replacement of the external package. ### Attack Path 1. An attacker compromises the external Skill publisher, registry entry, distribution infrastructure, or similarly trusted package source. 2. The attacker publishes a malicious release under the same mutable package identifier. 3. A user follows the documented installation command without selecting a known-safe immutable version. 4. The package manager retrieves and installs the attacker-controlled release. 5. The dependency executes within the OpenClaw environment and receives access to the capabilities granted to the Discord integration. 6. If Discord credentials and channel-management actions are enabled, the malicious dependency may use those privileges to access or m ...[truncated 790 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the external Skill to an audited immutable version or commit rather than installing the latest package by name. 2. Publish and verify a cryptographic checksum or signature for the approved dependency artifact. 3. Document the canonical registry and publisher identity so users can reject similarly named or untrusted packages. 4. Review the dependency's source and requested capabilities before installation and after every proposed upgrade. 5. Use a lockfile or equivalent integrity metadata where supported by OpenClaw or ClawHub. 6. Apply least privilege to the Discord bot. Enable only the actions required for forum, thread, and channel management. 7. Keep sensitive Discord administration permissions disabled unless the channel-creation feature is actively needed. 8. Test dependency upgrades in an isolated environment before production deployment. 9. Document a trusted version and explicit upgrade procedure in both `SKILL.md` and `reference.md`.