T08 · Insecure Dependencies
Warning
- Location
SKILL.md:203- Finding
Unpinned Third-Party Packages Are Executed Through npx
- Content
View full analysis
Agent client to install for (see references/npx-skills-agents.md) # -g Install globally (home dir); omit for project-local install # -y Skip confirmation (requires --agent and -g/-local to be set) npx skills add aliyun/alibabacloud-aiops-skills \ --skill \ --full-depth \ --agent qwen-code \ -g -y # Option B: Using npx clawhub install (OpenClaw ecosystem) npx clawhub install ``` ### Technical Analysis The installation workflow invokes the `skills` and `clawhub` packages through `npx` without specifying reviewed package versions or integrity hashes. If the packages are not already available locally, `npx` can retrieve their current versions from the configured package registry and execute them immediately. The effective executable code can therefore change after this skill has been audited. The first command compounds the risk by using `-g -y`, which requests a global installation and suppresses the package's confirmation prompt. Although `SKILL.md` states that installation should occur only when the user requests it, user consent does not establish the integrity of the package version retrieved at execution time. The audited project does not itself contain malicious scripts. The vulnerability is the unpinned trust relationship with externally maintained packages and their transitive dependencies. ### Attack Path 1. A user asks the agent to install or use a selected skill. 2. The ag ...[truncated 1617 chars]- Remediation
View remediation
add aliyun/alibabacloud-aiops-skills ... ``` Apply equivalent version pinning to `clawhub`. 2. Verify package integrity using a trusted lockfile, package-manager integrity metadata, or independently published checksums. 3. Prefer project-local installation. Do not use `-g` unless the user specifically requests a global installation and understands its broader scope. 4. Do not use unattended `-y` installation by default. Immediately before execution, show the user: - Exact package and version. - Registry or source repository. - Selected skill name. - Installation destination. - Whether installation is local or global. 5. Require explicit confirmation after presenting the final command, even if the earlier user request generally mentioned installation. 6. Run installation in a restricted environment with minimal filesystem, credential, and network access where supported. 7. Verify the installed files and package provenance before loading the new skill into an agent session. ]]>