T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:143
- Finding
- Unpinned Third-Party MCP Package Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 143-149 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium **Vulnerable code:** ```text openclaw config set mcpServers.op0.command "npx" openclaw config set mcpServers.op0.args '["@op0live/mcp-server"]' openclaw config set mcpServers.op0.env.OP0_API_KEY "op0_live_YOUR_KEY" openclaw config set mcpServers.op0.env.OP0_API_URL "https://api.op0.live/functions/v1/altar-api-public" ``` ### Technical Analysis The optional MCP configuration directs OpenClaw to execute `@op0live/mcp-server` through `npx` without specifying an exact version or an integrity constraint. Package resolution is therefore mutable: a later registry release can differ from the version that existed when this Skill was audited. The package implementation is not included in the audited project, which contains only `SKILL.md` and `package.json`. Consequently, its installation scripts and runtime behavior cannot be verified from this artifact. Because the process receives `OP0_API_KEY`, a compromised or malicious package release could read and disclose that credential. It could also perform other actions available to the local process under the invoking user's permissions. ### Attack Path 1. An attacker compromises the publisher account, package registry entry, or a future release of `@op0live/mcp-server`. 2. The user follows the documented MCP configuration, which references the package without an exact version. 3. OpenClaw invokes `npx`, which resolves and runs the mutable registry package. 4. Malicious package code executes with the permissions of the OpenClaw process. 5. The code reads the configured `OP0_API_KEY` from its environment. 6. The attacker can exfiltrate the key, issue authenticated OP0 API requests, and access any additional files or resources permitted to that process. ### Impact Assessment Successful exploitation can compromise the c ...[truncated 833 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the MCP server to a reviewed exact version, for example `@op0live/mcp-server@1.2.3`, rather than resolving the latest release. 2. Verify the package's publisher, source repository, release provenance, and package contents before recommending execution. 3. Use a lockfile and registry integrity hashes where the deployment mechanism supports them. 4. Avoid automatic installation at runtime. Prefer a separately reviewed, explicitly installed package. 5. Disable lifecycle scripts with `--ignore-scripts` where compatible, while recognizing that this does not prevent malicious runtime behavior. 6. Run the MCP server in a restricted environment with minimal filesystem access, network access limited to the required OP0 endpoint, and no unrelated credentials. 7. Provide the API key only to the component that requires it, rotate it after suspected exposure, and apply server-side restrictions and monitoring where available. 8. Document the trusted package version and establish a review process before upgrading it.