T08 · Insecure Dependencies
Warning
- Location
SKILL.md:42- Finding
Unpinned Third-Party Package and Skill Installation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:42-50
Vulnerability Type: Supply-chain exposure through mutable and unverified dependencies
Risk Level: MediumVulnerable Code:
bash ## Recommended ClawHub skills to install alongside ```bash npx clawhub@latest install academic-research # Legal research via OpenAlex npx clawhub@latest install pdf-documents # Contract PDF parsing npx clawhub@latest install arc-security-audit # Compliance audit trail npx clawhub@latest install agent-audit-trail # Hash-chained audit logging npx clawhub@latest install firm-orchestration # This pack depends on ittext ### Technical Analysis The documented commands use `npx clawhub@latest`, which resolves a mutable npm package version at execution time. `npx` may download and execute that package on the local system. The commands then install five externally maintained skills without pinning their versions, recording integrity hashes, or identifying reviewed source revisions. Consequently, the code and skill content executed or installed by a user can differ from what was available when this package was audited. Compromise of the npm publisher, registry distribution process, ClawHub publisher accounts, or any recommended skill could introduce malicious code or hostile Agent instructions. The risk is especially relevant to `firm-orchestration`, which the documentation describes as a dependency while still installing it through an unpinned external command. ### Attack Path 1. An attacker compromises the `clawhub` npm publisher, a recommended skill publisher, or the relevant package distribution channel. 2. The attacker publishes a malicious release under the existing package or skill name. 3. A user follows the installation instructions in `SKILL.md`. 4. `npx clawhub@latest` retrieves and executes the current mutable npm release. 5. The invoked package retrieves and installs t ...[truncated 1012 chars]- Remediation
View remediation
Remediation Suggestions
- Replace
clawhub@latestwith an exact, reviewed version of the CLI. - Pin every companion skill to an immutable version or commit identifier rather than installing its current release by name.
- Verify package integrity through lockfiles, registry integrity hashes, signed release artifacts, or equivalent cryptographic controls.
- Document the expected publisher and canonical source repository for each dependency so users can detect typosquatting or publisher changes.
- Audit each companion skill, including its scripts, transitive dependencies, requested tools, and Agent instructions, before recommending it.
- Prefer a reviewed local or reproducible installation process over transient
npxexecution. - Execute installation in a restricted environment without production credentials or sensitive legal documents, using least-privilege filesystem and network access.
- Separate mandatory dependencies from optional recommendations and state the exact compatible version of
firm-orchestration. - Add an update-review process so dependency versions are changed only after security review and integrity metadata is updated.
- Replace