T08 · Insecure Dependencies
- Location
README.md:39- Finding
Unpinned Package Execution in Installation Instructions
- Content
View full analysis
Vulnerability Details
File Location:
README.md, lines 39-41
Vulnerability Type: Unpinned third-party package execution
Risk Level: MediumVulnerable Code
bash npx clawhub install stealth-breakTechnical Analysis
The documented installation command invokes
clawhubthroughnpxwithout specifying an exact package version or integrity constraint. If the package is not already available locally,npxmay download and execute the version currently resolved by the configured package registry.Because package resolution is mutable, the code executed during installation can differ from the version that existed when this Skill was reviewed. Compromise of the package, its publisher account, the registry resolution path, or a newly published malicious version could therefore introduce arbitrary behavior through the CLI itself or its package lifecycle mechanisms.
The repository does not itself contain malicious dependency code, and exploitation depends on compromise or unexpected modification of the externally resolved package.
Attack Path
- An attacker compromises the
clawhubpackage, its publisher account, or an applicable package-resolution source. - The attacker publishes a malicious version that remains compatible with the unversioned package name.
- A user follows the README and runs
npx clawhub install stealth-break. npxresolves and downloads the attacker-controlled package version.- The downloaded CLI or associated lifecycle code executes with the privileges of the user running the installation command.
- The malicious package can access or modify resources available to that user.
Impact Assessment
Successful exploitation could result in arbitrary code execution under the installing user's account. The reachable scope includes user-readable files, user-writable files, environment variables, credentials exposed to the process, and network resources accessible ...[truncated 251 chars]
- An attacker compromises the
- Remediation
View remediation
Remediation Suggestions
- Pin
clawhubto an exact, reviewed version in the installation command, for example:bash npx clawhub@<reviewed-exact-version> install stealth-break - Do not use a floating tag such as
latest, a caret range, or a tilde range for security-sensitive installation workflows. - Document the expected registry and verified package publisher so users can validate package provenance.
- Where supported, verify the downloaded package against a trusted checksum, signature, or registry provenance attestation before execution.
- Review the pinned package version, including lifecycle scripts and transitive dependencies, before recommending it.
- Execute installation with a least-privileged user and avoid exposing unrelated credentials or sensitive environment variables to the process.
- Update the pinned version only through a controlled review process.
- Pin