T08 · Insecure Dependencies
Warning
- Location
- README.md:25
- Finding
- Unpinned Remote Package Execution in Installation Instructions## Vulnerability Details **File Location**: `README.md`, line 25 **Vulnerability Type**: Supply-chain risk caused by executing a mutable package release **Risk Level**: Medium ### Vulnerable Code ```bash npx --yes clawhub@latest install @orionshaowswmw/arena-power-user-playbook ``` ### Technical Analysis The documented installation command directs `npx` to download and execute the mutable `latest` release of the `clawhub` package. The `--yes` option suppresses the normal installation confirmation, while neither the installer nor the requested Skill is pinned to an immutable version or verified digest before execution. Consequently, the code executed by this command may differ from the code reviewed during this audit. The risk is confined to users who follow this installation instruction; the bundled Python scripts themselves do not retrieve or execute remote payloads. ### Attack Path 1. An attacker compromises the package registry, the `clawhub` publisher account, or a dependency included in a future `latest` release. 2. The attacker publishes a modified release that contains malicious installation code. 3. A user follows the documented command. 4. `npx --yes` downloads and executes the attacker-controlled release without an interactive confirmation. 5. The malicious package runs with the privileges and environment access of the user who invoked the command. ### Impact Assessment Successful exploitation could allow arbitrary code execution under the installing user's account. Depending on that user's privileges and environment, the malicious installer could read accessible files and credentials, modify local data, install additional software, or establish persistence. The command does not itself request elevated privileges, so the direct privilege boundary is the invoking user's existing permissions.
- Remediation
- ## Remediation Suggestions - Replace `clawhub@latest` with an exact, audited package version. - Pin the Skill to an exact version or immutable content digest where the registry supports it. - Remove `--yes` so unexpected package installation requires explicit confirmation. - Publish the expected installer and artifact hashes through a trusted channel. - Verify package provenance, signatures, and checksums before executing the installer. - Retain the existing post-installation tree-hash verification, but clarify that it does not protect against malicious code already executed by `npx`. - Prefer an installation workflow that downloads the package without executing it, verifies its integrity, and only then invokes reviewed code.