T08 · Insecure Dependencies
Error
- Location
- SKILL.md:26
- Finding
- Unpinned npm and MCP Dependencies Execute Mutable Code with Wallet Access<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 8-18, 26-39, and 69-72 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code Snippets ```yaml metadata: openclaw: requires: anyBins: - omniology-mcp - npx primaryEnv: OMNIOLOGY_KEYPAIR_PATH envVars: - name: OMNIOLOGY_KEYPAIR_PATH required: true description: Path to your agent's local Solana keypair JSON. The agent holds this key and signs its own entries; it never leaves your machine. `npx omniology-init` creates it. - name: OMNIOLOGY_AGENT_ID required: true description: Your agent_id from registration (written by `npx omniology-init`). Auto-injected into the tools that need it. ``` ```markdown Run the onboarding wizard once — it creates your wallet, registers your agent, and wires the Omniology MCP into OpenClaw: \`\`\` npx omniology-init \`\`\` That registers the MCP via `openclaw mcp add` (the agent's key + id are set in the server's env). If you'd rather do it by hand: \`\`\` openclaw mcp add omniology \ --command omniology-mcp \ --env OMNIOLOGY_KEYPAIR_PATH=<path-to-keypair.json> \ --env OMNIOLOGY_AGENT_ID=<your-agent-id> \`\`\` Then `openclaw mcp reload`. Fund the wallet with a little USDC (no SOL needed — the engine pays gas) and verify readiness any time with `npx omniology-init --verify`. ``` ```markdown - **Use the MCP through your runtime** (this ClawHub skill, or `npx @omniology/mcp-server@latest` wired into your host). Don't call the engine over raw HTTP/SSE — that path has no signing and no `agent_id` injection, and it's where agents lose the most time. ``` ### Technical Analysis The Skill directs the operator to execute npm packages without pinning them to immutable versions. In particular, `npx omniology-init` resolves a package version at execution time, while `npx @omniology/mcp-server@latest` explicitly requests the latest mutable release ...[truncated 2743 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every npm package to an exact reviewed version, for example: ```sh npx --yes omniology-init@X.Y.Z npx --yes @omniology/mcp-server@X.Y.Z ``` Do not use `@latest` or unversioned package execution. 2. Distribute a lockfile containing npm integrity hashes and require installation with `npm ci` from a reviewed package manifest rather than resolving dependencies dynamically. 3. Publish the authoritative package source and release provenance. Verify package signatures, checksums, and build attestations before execution. 4. Run onboarding and MCP components in an isolated environment with: - Read-only access to unrelated files. - No access to SSH keys, cloud credentials, browser profiles, or other wallets. - Restricted outbound network access limited to documented endpoints. - A dedicated, unprivileged operating-system account. 5. Use a dedicated Solana wallet containing only the minimum funds needed for the service. Do not reuse a wallet that controls unrelated or high-value assets. 6. Enforce transaction constraints outside the MCP package where possible, including destination allowlists, per-transaction caps, cumulative spending limits, allowance expiration, and explicit operator confirmation for paid actions. 7. Document package names, exact versions, expected hashes, network endpoints, transaction programs, and required filesystem permissions so operators can validate the trust boundary. 8. Rotate the Solana keypair immediately if an untrusted or subsequently compromised package version has had access to it. Revoking only the Entry Vault allowance does not remediate exposure of the underlying private key. ]]>