T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:17
- Finding
- Unpinned Third-Party Package Installed Globally and Activated as a Plugin## Vulnerability Details **File Location**: `SKILL.md`, lines 17–20 **Vulnerability Type**: Unpinned and unaudited third-party executable dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ## Prerequisites The ContextClaw plugin must be installed: ```bash npm install -g @rmruss2022/contextclaw openclaw plugins install @rmruss2022/contextclaw ``` ``` ### Technical Analysis The documented installation commands retrieve the latest available release of `@rmruss2022/contextclaw` without specifying an immutable version or integrity hash. The package is installed globally and subsequently activated as an OpenClaw plugin. An npm installation may execute package lifecycle scripts under the privileges of the invoking user. Plugin activation may also execute package code and grant it access to OpenClaw resources. The project contains only `SKILL.md`; the referenced package implementation is not included, so its lifecycle scripts, transitive dependencies, runtime behavior, and documentation claims cannot be audited from this artifact. This finding establishes an unsafe supply-chain configuration, but it does not establish that the current external package is malicious. ### Attack Path 1. An attacker compromises the npm publisher account, package repository, release workflow, or a transitive dependency. 2. The attacker publishes a malicious release under the existing package name. 3. A user follows the documented command without a version constraint: `npm install -g @rmruss2022/contextclaw`. 4. npm resolves the mutable current release and may execute attacker-controlled lifecycle scripts during installation. 5. The user activates the package using `openclaw plugins install @rmruss2022/contextclaw`. 6. Malicious plugin code then executes within the user and OpenClaw environment. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user performing t ...[truncated 495 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the package to a specifically reviewed version rather than resolving the mutable latest release. 2. Verify package integrity using a trusted lockfile, registry integrity metadata, signed provenance, or an independently published checksum. 3. Audit the exact npm artifact, including lifecycle scripts, bundled files, runtime entry points, and transitive dependencies, before recommending installation. 4. Establish verifiable provenance between the referenced source repository and the published npm package. 5. Where operationally feasible, install with lifecycle scripts disabled during initial inspection, then explicitly permit only reviewed installation behavior. 6. Avoid global installation where possible. Run the plugin under a dedicated, least-privileged account or isolated environment with access limited to required session directories. 7. Document the permissions, network access, filesystem scope, and plugin lifecycle behavior required by the package. 8. Require explicit user confirmation before plugin activation and before any non-dry-run deletion operation.