T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:40
- Finding
- Unpinned Third-Party Package Execution and Skill Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 40–46 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Complete Code Snippet**: ```bash ## Recommended ClawHub skills to install alongside ```bash npx clawhub@latest install academic-research # PubMed / clinical trial search npx clawhub@latest install admet-prediction # Drug candidate ADMET analysis npx clawhub@latest install pdf-documents # Clinical study PDF parsing npx clawhub@latest install arc-security-audit # 21 CFR Part 11 audit trail npx clawhub@latest install firm-orchestration # A2A orchestration backbone ``` ### Technical Analysis The documented commands use `npx clawhub@latest`, which retrieves and executes a mutable release of the `clawhub` npm package. The commands also install five third-party skills without pinning them to audited versions, immutable commits, or verified integrity hashes. Consequently, the code that executes and the skill content installed at a later date may differ from what was available when this project was audited. A compromised package publisher, registry account, package release, or companion skill could exploit this supply-chain trust boundary. The five referenced companion skills were not included in the audited project, so their behavior could not be independently verified. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the package distribution path, or one of the referenced companion skills. 2. The attacker publishes a malicious release under the mutable version selected by `@latest`, or changes an unpinned companion skill. 3. A user follows the installation commands from `SKILL.md`. 4. `npx` downloads and executes the currently resolved `clawhub` package. 5. The installer retrieves and activates unaudited companion skill content. 6. Malicious installation logic or skill instructions execute with the permissions and data access available to the inv ...[truncated 801 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `npx clawhub@latest` with an exact, reviewed package version. 2. Enforce npm integrity verification through a lockfile, approved checksums, package signatures, or an internally controlled artifact repository. 3. Pin each companion skill to an immutable version, release digest, or commit hash rather than resolving its current release. 4. Audit the complete contents and transitive dependencies of every companion skill before installation or activation. 5. Perform installation in a restricted sandbox with no production credentials, PHI, patient records, or writable access to sensitive host locations. 6. Apply least privilege to the installer and installed skills, permitting only the tools, files, network destinations, and session access required for their stated functions. 7. Establish an allowlist and controlled update process so version changes require security review and integrity validation. 8. Scan newly resolved packages for installation scripts, unexpected network access, executable payloads, and instruction-hijacking behavior before deployment.