T08 · Insecure Dependencies
Error
- Location
- SKILL.md:77
- Finding
- Unpinned Third-Party Executables Receive Sensitive Capabilities## Vulnerability Details **File Location**: `SKILL.md`, lines 77-85 **Vulnerability Type**: Unpinned third-party dependencies executed with access to credentials and host-mounted files **Risk Level**: High ### Vulnerable Code ```json { "mcp": { "servers": { "filesystem-secure": { "command": "docker", "args": ["run", "-i", "--rm", "-v", "/path/to/allowed:/data", "openclaw/mcp-filesystem-secure"] }, "github": { "transport": "stdio", "command": "npx", "args": ["-y", "mcp-github"], "env": {"GITHUB_TOKEN": "..."} } } } } ``` ### Technical Analysis The proposed configuration executes two third-party artifacts without immutable version constraints: - `openclaw/mcp-filesystem-secure` is referenced without a version tag or image digest. The container receives a read/write host bind mount at `/data`. - `npx -y mcp-github` automatically downloads and executes the package selected by the npm registry without an exact version, lockfile, or integrity verification. The resulting process receives `GITHUB_TOKEN`. Mutable dependency references allow the effective executable content to change after the Skill has been reviewed. A compromised registry account, malicious package release, replaced image tag, or unexpected upstream update could therefore introduce attacker-controlled code. The project contains no implementation, lockfile, digest, signature policy, source reference, or verification procedure that establishes the integrity of these artifacts. ### Attack Path 1. An attacker compromises the npm package, container repository, publisher account, or mutable image tag, or causes a malicious release to become the version resolved by the configuration. 2. A user or agent applies the generated MCP configuration. 3. Docker pulls the mutable `openclaw/mcp-filesystem-secure` image, or `npx -y` downloads and automatically executes t ...[truncated 1070 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the npm package to a reviewed exact version rather than resolving the latest release, and use a lockfile with integrity hashes. 2. Avoid unattended `npx -y` execution. Install dependencies through a controlled build process and require explicit approval for version changes. 3. Pin the Docker image by immutable digest, for example `image@sha256:...`, after reviewing and verifying the corresponding source and build provenance. 4. Verify dependency publishers, official source repositories, signatures, checksums, and software bill of materials before execution. 5. Run dependencies with least privilege. Use a read-only bind mount where writes are unnecessary, narrow the mounted path, run as a non-root user, drop Linux capabilities, enable a read-only container filesystem, and apply network restrictions. 6. Use a fine-grained, short-lived GitHub credential with only the minimum required repository and API permissions. Do not expose broader personal access tokens to the MCP process. 7. Store credentials through a dedicated secret manager rather than embedding them in reusable configuration, and rotate any credential suspected of exposure. 8. Add an update-review process so dependency version or digest changes trigger source review, security scanning, and integrity verification before deployment.