T08 · Insecure Dependencies
Warning
- Location
README.md:14- Finding
Unpinned package execution in English installation instructions
- Content
View full analysis
Vulnerability Details
File Location:
README.md:14-18
Vulnerability Type: Unpinned third-party package execution
Risk Level: MediumComplete Code Snippet:
markdown ## Install ```bash npx clawhub install maxhub-youtubetext ### Technical Analysis The installation instructions invoke `clawhub` through `npx` without specifying an exact package version, lockfile, integrity hash, or verified local artifact. Depending on the local package-manager state, `npx` can download and execute the package version currently selected by the configured registry. Consequently, the code executed during installation is not fully represented by this audited project. Its behavior can change after review if the package is updated, taken over, or served from a compromised or attacker-controlled registry. This creates a supply-chain trust boundary that is broader than necessary for installing the Skill. ### Attack Path 1. An attacker compromises the registry account, publication process, or dependency chain associated with the `clawhub` package, or influences the user's configured package registry. 2. The attacker publishes or serves a malicious package version that satisfies the unpinned request. 3. A user follows the documented command: `npx clawhub install maxhub-youtube`. 4. `npx` retrieves and executes the attacker-controlled package version. 5. The malicious installer runs with the privileges of the user executing the command. ### Impact Assessment Successful exploitation could execute arbitrary code under the installing user's account. Depending on that account's permissions and environment, this may allow access to user-readable files, environment variables, developer credentials, Skill configuration, network resources, and writable project or configuration directories. If the command is run from a privileged account, the impact could extend to privileged system resources. The project does not it ...[truncated 188 chars]- Remediation
View remediation
Remediation Suggestions
- Pin
clawhubto a reviewed, trusted version, for example:bash npx --yes clawhub@X.Y.Z install maxhub-youtube - Document the expected package registry and recommend checking it before execution.
- Publish and verify package provenance, signatures, or integrity hashes where supported.
- Prefer a lockfile-backed installation process or a locally installed, version-pinned CLI over implicit retrieval of the latest package.
- Avoid recommending execution under an administrator or root account.
- Establish a release process that reviews the pinned installer version whenever it is updated.
- Pin
