T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:14
- Finding
- Unpinned Globally Installed Third-Party Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 14–18 **Vulnerability Type**: Supply-chain risk from an unpinned, unaudited npm dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ## Installation ```bash npm install -g @ofan/disclaw disclaw --version ``` ``` ### Technical Analysis The installation instructions globally install and execute `@ofan/disclaw` without pinning an exact version or verifying package integrity. The audited project contains no source code for that package, dependency lockfile, checksum, signature, or reproducible-build information. Therefore, the behavior of the installed executable cannot be verified from this artifact and may change independently after the Skill has been reviewed. Global npm installation can also execute package lifecycle scripts with the invoking user's privileges. This creates a supply-chain boundary through which a compromised publisher account, malicious package release, or registry compromise could introduce arbitrary local behavior. The dependency is expected to interact with sensitive resources, including the Discord bot token, OpenClaw gateway token, OpenClaw configuration, workspace files, and Discord administrative APIs. The documentation's claims concerning managed scope, snapshots, atomic updates, and credential handling cannot be independently confirmed because the executable implementation is absent. ### Attack Path 1. An attacker compromises the npm publisher account, package repository, release process, or registry entry for `@ofan/disclaw`. 2. The attacker publishes a malicious version under the same package name. 3. A user follows the documented command `npm install -g @ofan/disclaw`, which resolves the current registry version rather than a reviewed, immutable version. 4. Malicious npm lifecycle code may execute during installation, or malicious behavior may run when `disclaw --version` or a later command is invoked. 5. The ...[truncated 1081 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the package to a specific reviewed version, for example `@ofan/disclaw@X.Y.Z`, rather than resolving the latest release. 2. Publish the dependency source alongside the Skill or provide a verifiable source repository and commit identifier so its implementation can be audited. 3. Verify registry integrity metadata, package signatures, provenance attestations, and checksums before installation. 4. Use a lockfile or equivalent immutable dependency manifest where installation tooling permits it. 5. Prefer a project-local installation over a global installation and invoke the pinned binary from the controlled project environment. 6. Disable npm lifecycle scripts during installation where compatible, then explicitly run only reviewed setup steps. 7. Execute the tool under a dedicated, least-privileged operating-system account or isolated container. 8. Scope Discord bot and OpenClaw gateway permissions to the minimum required resources and actions. 9. Avoid exposing credentials through command-line arguments; use protected configuration or narrowly scoped environment variables with appropriate file permissions. 10. Add automated dependency scanning, release provenance verification, and periodic review of the pinned package version.