T08 · Insecure Dependencies
Warning
- Location
- openclaw.json:8
- Finding
- Unpinned Remote npm Package Execution in a Private-Key Trust Boundary## Vulnerability Details **File Location**: `openclaw.json`, lines 8–15 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```json "command": "npx", "args": ["-y", "@piprail/mcp"], "env": { "PIPRAIL_PRIVATE_KEY": "0xYOUR_PRIVATE_KEY", "PIPRAIL_CHAIN": "base", "PIPRAIL_MAX_AMOUNT": "0.10", "PIPRAIL_MAX_TOTAL": "5.00", "PIPRAIL_TOKENS": "USDC" } ``` The same unsafe package-resolution pattern also appears in: - `SKILL.md`, lines 18–24 and 88–91 - `README.md`, lines 28–33 - `verify.mjs`, lines 28–29 Relevant `verify.mjs` code: ```js const localBin = process.env.PIPRAIL_MCP_BIN const [command, baseArgs] = localBin ? [process.execPath, [localBin]] : ['npx', ['-y', '@piprail/mcp']] ``` ### Technical Analysis The OpenClaw configuration launches `@piprail/mcp` through `npx -y` without specifying an exact package version or integrity hash. Consequently, the code executed at startup can change after this Skill has been reviewed. The `-y` option permits package installation without interactive confirmation. This is particularly sensitive because the downloaded process is explicitly supplied with `PIPRAIL_PRIVATE_KEY`. It also runs under the user's operating-system identity and is not constrained by a sandbox in the supplied configuration. The project contains neither the MCP implementation nor a dependency lockfile, so this audit cannot independently verify the documented claims that the private key remains local or that spending limits are enforced before transactions are signed. The verifier uses the same floating dependency by default. Although it generates a throwaway key rather than passing a funded wallet key, it still executes remotely resolved code in the user's context. Its child environment also preserves `HOME`: ```js const child = spawn(command, baseArgs, { stdio: ['pipe', 'pipe', 'ignore'], env: { PATH: process.env.PATH, HOME: process.env.HOME, PIPRAIL_PRIVATE_KEY: '0x' + r ...[truncated 2187 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@piprail/mcp` to an exact audited version rather than using a floating package reference: ```json "command": "npx", "args": ["-y", "@piprail/mcp@X.Y.Z"] ``` 2. Prefer installing dependencies ahead of time from a committed lockfile with npm integrity metadata, then execute the pinned local binary. Avoid downloading executable code whenever OpenClaw starts. 3. Include or vendor the exact MCP implementation or audited build artifact in the review scope. Verify its provenance and cryptographic digest before execution. 4. Establish a controlled upgrade process in which dependency changes require source review, lockfile review, automated scanning, and explicit approval. 5. Run the MCP process in a sandbox or dedicated operating-system account with: - Restricted filesystem access. - A minimal environment. - Network access limited to required RPC and payment endpoints. - No access to unrelated OpenClaw credentials or user files. 6. Use a dedicated, minimally funded wallet rather than a primary wallet. Enforce on-chain allowances, account-level policies, or multisignature controls so security does not depend solely on application-level spending caps. 7. Keep wallet secrets in a dedicated secret manager or narrowly scoped credential broker where supported, rather than storing them directly in a general configuration file. 8. Apply the same pinning and integrity controls to `verify.mjs`, `SKILL.md`, and `README.md` so testing and documented installation procedures do not reintroduce the floating dependency.