T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:524
- Finding
- Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md:524-527` **Vulnerability Type**: Supply-chain risk caused by an unpinned global dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ### "gog: command not found" Install gog: `npm install -g gog` or check your OpenClaw installation — gog should be bundled. ``` The same unsafe recommendation is repeated in `scripts/setup.sh:17-22`: ```bash # Check gog CLI echo "Checking gog CLI..." if ! command -v gog &>/dev/null; then echo "❌ gog CLI not found." echo " Install it via OpenClaw or run: npm install -g gog" exit 1 fi ``` ### Technical Analysis The project recommends installing the latest npm package named `gog` globally without: - Pinning a reviewed version - Verifying package provenance or publisher identity - Checking an integrity hash or signature - Using a lockfile - Restricting npm lifecycle scripts The setup script does not execute the installation automatically, which limits immediate exploitability. However, users are explicitly directed to run the command when the required executable is unavailable. A global npm installation can execute package lifecycle scripts with the privileges of the invoking user. Because this tool is subsequently expected to access Google Calendar and potentially Gmail, a malicious, compromised, replaced, or incorrectly identified package could impersonate the expected CLI and capture sensitive data or authorization material. ### Attack Path 1. An attacker compromises the referenced npm package, publishes a malicious version under the expected name, or causes users to resolve an unintended package. 2. A user runs the documented `npm install -g gog` command. 3. npm retrieves the current package version and may execute attacker-controlled lifecycle scripts. 4. The package installs a globally available `gog` executable under the user's environment. 5. The user follows the project instructions and invokes commands such as `gog auth login`, `gog c ...[truncated 1066 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the bare package name with a link to the verified official distribution and clearly identify its publisher and repository. 2. Pin installation to a reviewed version, for example: ```bash npm install -g gog@<reviewed-version> ``` 3. Publish and verify the expected package integrity hash or cryptographic signature. 4. Prefer installation through OpenClaw's trusted, bundled distribution when available. 5. Avoid elevated installation and explicitly warn users not to run the command with `sudo`. 6. Consider disabling lifecycle scripts during installation where compatible: ```bash npm install -g gog@<reviewed-version> --ignore-scripts ``` 7. After installation, validate the executable path, package version, publisher, and checksum before requesting Google authentication. 8. Apply the same hardened guidance to both `SKILL.md:524-527` and `scripts/setup.sh:17-22`.