T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:19
- Finding
- Unpinned and Unaudited Third-Party npm Dependencies## Vulnerability Details **File Location**: `SKILL.md`, lines 19–21, 79–81, and 100–102 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Affected code:** Lines 19–21: ```bash npm install @clawhub/nsfw-detector ``` Lines 79–81: ```bash npm install @clawhub/url-reputation ``` Lines 100–102: ```bash npm install @raghulpasupathi/nsfw-detection ``` ### Technical Analysis The skill directs users to install three third-party npm packages without specifying reviewed versions. The project contains no package lockfile, package integrity hashes, vendored source code, dependency manifest, or implementation that would allow the installed components to be audited against the documented behavior. An unversioned `npm install` normally resolves a mutable package release from the configured npm registry. npm packages can define lifecycle scripts, including installation hooks that execute locally during installation. Consequently, compromise of a publisher account, malicious release replacement, dependency confusion involving the configured registry, or compromise of a transitive dependency could result in attacker-controlled code executing on the user's system. The instructions also reference packages under two different publisher scopes, `@clawhub` and `@raghulpasupathi`, without documenting their trust relationship or provenance. Although `SKILL.md` claims that the detector uses a local ONNX model and no external API, the repository provides no implementation or model artifact with which to verify that claim. ### Attack Path 1. A user follows the installation commands in `SKILL.md`. 2. npm resolves the latest package versions from the user's configured registry because no versions are pinned. 3. An attacker compromises a publisher, publishes a malicious package version, influences dependency resolution through an unsafe registry, or compromises a transitive dependency. 4. npm downloads ...[truncated 1125 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every direct dependency to a specific, reviewed version rather than allowing npm to resolve the latest release. 2. Provide a dependency manifest and commit a lockfile containing registry-resolved integrity values. 3. Use `npm ci` in automated and reproducible installations so dependency resolution matches the reviewed lockfile. 4. Use `npm ci --ignore-scripts` or an equivalent policy where lifecycle scripts are unnecessary. If scripts are required, document and audit each script before enabling it. 5. Verify package ownership, provenance, registry source, signatures, and publisher identity for both the `@clawhub` and `@raghulpasupathi` scopes. 6. Audit direct and transitive dependency source code, including model-loading behavior and all network access. 7. Publish or reference immutable, verifiable source and ONNX model artifacts, including cryptographic hashes, so the claim of local-only processing can be validated. 8. Run installation and inference in a least-privileged sandbox or container without access to sensitive credentials, host files, or production networks. 9. Enable dependency monitoring and require security review before updating pinned package or model versions.