T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:14
- Finding
- Unpinned npm Package Is Automatically Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 14–25 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```markdown 1. Use `exec` with `npx -y mcporter ...` from `/Users/claw/.openclaw/workspace`. 2. Query the Linear MCP server configured in `config/mcporter.json`. 3. Prefer read-only queries first. 4. Summarize findings before proposing writes. 5. Only mutate Linear when the user clearly asks, or when the workflow explicitly calls for it. Useful commands: ```bash cd /Users/claw/.openclaw/workspace && npx -y mcporter call linear.list_issues team=FB limit=10 cd /Users/claw/.openclaw/workspace && npx -y mcporter call linear.get_issue id=FB-12345 cd /Users/claw/.openclaw/workspace && npx -y mcporter call linear.list_issue_statuses team=FB cd /Users/claw/.openclaw/workspace && npx -y mcporter call linear.list_issue_labels team=FB ``` ``` The same unsafe invocation pattern is also used for write operations at `SKILL.md`, lines 126–134: ```markdown ## Mutation commands Only use these when needed: ```bash cd /Users/claw/.openclaw/workspace && npx -y mcporter call linear.save_issue id=FB-12345 state=处理中 cd /Users/claw/.openclaw/workspace && npx -y mcporter call linear.save_issue id=FB-12345 labels='["会员支付","Android"]' cd /Users/claw/.openclaw/workspace && npx -y mcporter call linear.save_comment issueId=FB-12345 body='处理中，已复现。' ``` ``` ### Technical Analysis The skill instructs the agent to run `npx -y mcporter` without specifying a reviewed package version. If the package is absent locally, `npx` can retrieve it from the configured npm registry and execute it immediately. The `-y` option suppresses the normal installation confirmation, eliminating an opportunity to inspect or reject an unexpected package. Consequently, the code that executes during a skill invocation is ...[truncated 2269 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `mcporter` to a specific, reviewed version rather than allowing npm to resolve the latest release: ```bash npx --no-install mcporter ... ``` Use this only after installing an explicitly pinned dependency through the project's package manifest and lockfile. 2. Add the reviewed package version to `package.json` and commit a lockfile containing npm integrity hashes. Install dependencies with: ```bash npm ci --ignore-scripts ``` If lifecycle scripts are genuinely required, review them before enabling them. 3. Invoke the trusted local binary instead of permitting automatic downloads: ```bash ./node_modules/.bin/mcporter call linear.list_issues team=FB limit=10 ``` 4. Configure npm to use an approved registry and enforce dependency provenance or integrity verification where supported. 5. Run the MCP client in a sandbox with restricted filesystem and network access. Do not expose unrelated secrets or credentials to its process environment. 6. Grant the Linear integration only the minimum required scopes. Prefer separate read-only and write-capable credentials so ordinary triage queries cannot mutate workspace data. 7. Require explicit approval immediately before write operations and validate the intended issue identifier, state, labels, and comment content. 8. Periodically review the pinned package and its transitive dependencies before upgrading. Apply version changes through a controlled dependency-review process rather than automatic resolution.