T08 · Insecure Dependencies
Error
- Location
SKILL.md:75- Finding
Unpinned Third-Party Package Execution Through npx
- Content
View full analysis
--slug --version 1.0.0 --tags "tag1,tag2" ``` `scripts/create_skill.sh:123`: ```bash echo " 7. Publish: npx clawhub publish skills/$SKILL_NAME --slug $SKILL_NAME --version 1.0.0" ``` ### Technical Analysis The documented publication workflow invokes `clawhub` through `npx` without specifying a reviewed package version, integrity hash, verified installation path, or offline-only execution policy. If the package is not already available locally, `npx` may resolve and download it from the configured package registry. The downloaded package can execute JavaScript and package lifecycle logic with the permissions of the user running the command. Because dependency resolution is not pinned, the effective code can change after this Skill has been reviewed. The risk applies both to the direct instruction in `SKILL.md` and to the publication command printed by `create_skill.sh`. ### Attack Path 1. An attacker compromises the resolved `clawhub` package, publishes a malicious future version, or influences the user's configured package registry. 2. A user follows the Skill's publication instructions. 3. `npx` resolves the unpinned package and downloads the attacker-controlled version when a trusted local copy is unavailable. 4. The package executes with the invoking user's privileges. 5. The malicious package can access files, environment variables, authentication tokens, and publication credentials available to that user before optionally forwarding execution to the expected CLI behavior. ### Impact Assessment Successful exploitation permits arbitrary code execution with the privileges of the user publishing the Skill. Potentially exposed resources include: - Files readable or wr ...[truncated 376 chars]- Remediation
View remediation
``` 2. Commit the generated lockfile and verify package integrity through the package manager. 3. Invoke only the verified local installation: ```bash ./node_modules/.bin/clawhub publish skills/ \ --slug \ --version 1.0.0 \ --tags "tag1,tag2" ``` 4. If `npx` must be used, prevent network installation and require an existing local package: ```bash npx --offline --no-install clawhub publish ... ``` 5. Pin the package version explicitly, verify its provenance and integrity before execution, and use a trusted registry. 6. Run publication in an isolated environment with only the minimum credentials and filesystem access required. 7. Update both `SKILL.md` and the command printed by `scripts/create_skill.sh` so they prescribe the same hardened workflow. ]]>