T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:7
- Finding
- Unpinned Third-Party Packages Executed Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:7-18`, `SKILL.md:31-33`, `SKILL.md:88-89` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code Snippets ```yaml metadata: { "openclaw": { "requires": { "bins": ["npx"] }, "install": [ { "id": "unhuman-npm", "kind": "node", "package": "unhuman", "bins": ["unhuman"], "label": "Install unhuman CLI (npm)", }, ], }, } ``` ```bash npx unhuman domains search myproject npx unhuman domains search myproject --tld com,dev,xyz npx unhuman domains search myproject --json ``` ```text A running agent-wallet daemon (`npx @moneydevkit/agent-wallet start`) ``` ### Technical Analysis The Skill instructs the agent to install or execute the third-party npm packages `unhuman` and `@moneydevkit/agent-wallet` without pinning exact versions or recording package integrity hashes. Depending on the local npm and `npx` configuration, invoking these commands can download package code from the configured npm registry and execute it with the permissions of the current user. Because the package implementations are not included in the audited project, their effective behavior cannot be verified from the reviewed artifact. An unqualified package reference can also resolve to a later release than the one originally reviewed. A compromised maintainer account, malicious release, registry compromise, or dependency-chain compromise could therefore change the code executed by the Skill after this audit. This risk is particularly significant for `@moneydevkit/agent-wallet`: the documented workflow gives it access to a wallet daemon that manages Bitcoin keys and can make real Lightning payments. The `unhuman` package also operates on domain-management tokens stored under `~/.unhuman/tokens.json`. ### Attack Path 1. An attacker compromises a ref ...[truncated 1679 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `unhuman` and `@moneydevkit/agent-wallet` to exact, independently reviewed versions rather than resolving unspecified current releases. 2. Maintain a lockfile containing registry-resolved integrity hashes and enforce it through a deterministic installation process such as `npm ci`. 3. Install reviewed packages ahead of execution and invoke them with `npx --no-install` or their fixed local binary paths, preventing runtime downloads. 4. Verify package provenance, publisher identity, signatures or attestations where available, and npm integrity metadata before installation. 5. Audit and pin transitive dependencies, not only the two direct packages. 6. Run domain and wallet tools in an isolated, least-privileged environment with narrowly scoped filesystem and network access. 7. Prevent the domain CLI from reading wallet key material, and expose only the minimum wallet interface needed for an explicitly approved payment. 8. Preserve the existing explicit user-confirmation requirement for `--wallet`, and display the destination, invoice, amount, domain, and renewal period before authorization. 9. Restrict permissions on `~/.unhuman/tokens.json` and wallet data directories to the owning user, and avoid exposing their contents through logs or command output. 10. Vendor the reviewed source or link to immutable source revisions so future audits can verify the actual code being executed. ]]>