T08 · Insecure Dependencies
Error
- Location
- SKILL.md:4
- Finding
- Unpinned Third-Party CLI Installed with Access to Wallet Credentials## Vulnerability Details **File Location**: `SKILL.md:4` and `SKILL.md:35-40` **Vulnerability Type**: Unpinned and unaudited third-party dependency **Risk Level**: High ### Vulnerable Code ```yaml metadata: { "openclaw": { "requires": { "bins": ["outsmart"], "env": ["PRIVATE_KEY", "MAINNET_ENDPOINT"] }, "install": [{ "id": "node", "kind": "node", "package": "outsmart", "bins": ["outsmart"], "label": "Install outsmart CLI (npm)" }] } } ``` ```bash npm i -g outsmart outsmart init # Enter your PRIVATE_KEY and MAINNET_ENDPOINT when prompted # Config saved to ~/.outsmart/config.env ``` ### Technical Analysis The Skill installs the unscoped npm package `outsmart` globally without pinning an exact version or verifying an integrity hash, package provenance, or signed release. Consequently, the code installed depends on whichever package version the npm registry resolves at installation time. Global npm installation may execute package lifecycle scripts with the installing user's permissions. The installed executable is subsequently given access to the `PRIVATE_KEY` environment variable and is expected to perform irreversible blockchain transactions. The repository contains no implementation of the CLI, so its credential handling, transaction construction, network communications, and installation behavior cannot be verified from the audited artifact. The referenced GitHub homepage also does not cryptographically establish that the npm artifact corresponds to reviewed source. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution chain, or a future package release. 2. The victim follows the Skill instructions and runs `npm i -g outsmart`. 3. npm retrieves the attacker-controlled current release because no version or integrity value is pinned. 4. Malicious code executes through an installation lifecycle script or when the `outsmart` binary is invoked. 5. The code reads the wallet privat ...[truncated 811 chars]
- Remediation
- ## Remediation Suggestions - Pin the npm dependency to an exact, independently reviewed version rather than resolving the latest release. - Lock and verify the package tarball with a cryptographic integrity hash. - Verify npm provenance and publisher identity, and ensure the published artifact corresponds to a specific reviewed source commit. - Audit the package source, transitive dependencies, lifecycle scripts, network behavior, key handling, and transaction construction before use. - Avoid global installation. Install the package in an isolated, non-privileged environment with a lockfile. - Disable npm lifecycle scripts during installation where compatible, and separately review any scripts that are genuinely required. - Restrict filesystem and network access through sandboxing or containerization. - Use a dedicated low-value wallet and require explicit user confirmation for transaction destinations and amounts. - Prefer a hardware wallet or external signer so the third-party CLI never receives the raw private key.