T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:235
- Finding
- Unpinned and Unaudited npm Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:235-238` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash # Deploy the skill: npm install healthcare-chatbot-pro claw skills deploy healthcare-chatbot-pro ``` ### Technical Analysis The setup instructions install `healthcare-chatbot-pro` without specifying an exact version, integrity hash, lockfile, or verified distribution source. The project contains only `SKILL.md`, so the package implementation cannot be reviewed as part of this audit. Running `npm install` can download mutable package content and execute npm lifecycle scripts such as `preinstall`, `install`, and `postinstall`. Consequently, a compromised package publisher, malicious future release, or registry supply-chain incident could introduce arbitrary code after this skill has been reviewed. The risk is elevated because the documented environment requires credentials for OpenAI, Twilio, EMR, and CRM services. The documentation also describes a Google service-account credential and clinical-record access. Malicious package code executing in the deployment environment could attempt to read any credentials available to that process. ### Attack Path 1. An attacker compromises the package publisher, registry account, or package distribution process. 2. The attacker publishes a malicious version of `healthcare-chatbot-pro`, potentially containing an npm lifecycle script. 3. An administrator follows the documented `npm install healthcare-chatbot-pro` instruction. 4. npm resolves the current mutable package version and downloads it. 5. Malicious lifecycle or runtime code executes with the privileges of the installing or deployment account. 6. The code attempts to access environment variables, local configuration, service-account material, or network-accessible healthcare systems. 7. Stolen credentials may then be used within the permissions granted to the affected s ...[truncated 793 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a reviewed exact version rather than allowing mutable resolution: ```bash npm install --save-exact healthcare-chatbot-pro@<reviewed-version> ``` 2. Commit and enforce a package lockfile using `npm ci` in deployment workflows. 3. Verify package ownership, provenance, signatures, and registry integrity metadata before installation. 4. Publish or vendor the corresponding source so the installed implementation can be audited. 5. Generate an SBOM and continuously scan the package and its transitive dependencies. 6. Disable lifecycle scripts during installation where operationally possible: ```bash npm ci --ignore-scripts ``` 7. If lifecycle scripts are necessary, review them explicitly and run installation in an isolated, unprivileged build environment without production secrets. 8. Inject production credentials only at runtime, after dependency installation, and scope every account to the minimum required permissions. 9. Use separate credentials for EMR read and write operations, with write access disabled unless explicitly required. ]]>