T08 · Insecure Dependencies
Warning
- Location
- README.md:20
- Finding
- Unpinned Remote Skill Installation Creates a Mutable Supply-Chain Boundary<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 20-23 **Vulnerability Type**: Unpinned package and skill installation **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add clawwizard/task-detection-thinking ``` ### Technical Analysis The documented installation command executes `npx skills` and installs the remotely identified skill `clawwizard/task-detection-thinking` without pinning either component to an immutable version, commit, or integrity digest. Consequently, the code installed by this command can differ from the code reviewed in this audit. The effective installation payload depends on the package registry and remote skill state at installation time. A compromised publisher account, registry package, ownership transfer, or malicious future release could therefore substitute attacker-controlled code. This issue is confined to the documented installation path; the audited `package.json` itself declares no runtime dependencies. ### Attack Path 1. An attacker compromises or gains publishing control over the `skills` package, the `clawwizard/task-detection-thinking` remote skill, or an associated distribution account. 2. The attacker publishes a malicious release under the same mutable name. 3. A user follows the documented unpinned `npx skills add clawwizard/task-detection-thinking` command. 4. `npx` resolves the current package version, and the installer resolves the current remote skill contents rather than an audited immutable artifact. 5. The malicious package or skill executes installation logic or places attacker-controlled scripts into the agent environment. 6. Subsequent skill invocation can execute those scripts with the privileges of the OpenClaw process or invoking user. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user running the installation command. Depending on that account's permissions, an attacker could read or modify agent workspaces, ...[truncated 265 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Pin the installer package to a reviewed exact version, for example `npx --package=skills@<exact-version> ...`. - Pin the skill to an immutable release, commit hash, or content digest if the installer supports it. - Publish and verify cryptographic checksums or signed provenance for released skill artifacts. - Use a lockfile or trusted internal mirror where possible. - Disable lifecycle scripts during retrieval unless they are explicitly required and audited. - Document verification steps that compare the downloaded artifact against the reviewed source revision. - Prefer a package-manager invocation that refuses implicit installation or unexpected version resolution. ]]>