T08 · Insecure Dependencies
Warning
- Location
- references/publish.md:8
- Finding
- Unpinned Global Installation of a Third-Party CLI## Vulnerability Details **File Location**: `references/publish.md`, lines 8-10 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium **Vulnerable Code**: ```bash npm i -g clawhub clawhub login clawhub whoami ``` ### Technical Analysis The publishing instructions install the latest available version of the third-party `clawhub` npm package globally without pinning an audited version or verifying package integrity. An npm installation may execute package lifecycle scripts with the privileges of the invoking user. The global installation also changes system-wide user tooling rather than isolating the dependency to the project. Because the selected package version can change after this skill has been reviewed, compromise of the package, its dependency chain, or its publishing account could introduce attacker-controlled code. The subsequent authentication command may expose newly created ClawHub credentials or session data to a compromised CLI. These commands are part of maintainer publishing guidance rather than the skill's declared read-only file-discovery behavior, increasing the exposed supply-chain surface without being required during normal skill operation. ### Attack Path 1. An attacker compromises the `clawhub` npm package, one of its transitive dependencies, or an authorized package-publishing account. 2. The attacker publishes a malicious version or adds a malicious installation lifecycle script. 3. A maintainer follows `references/publish.md` and runs `npm i -g clawhub`, which resolves the mutable latest package version. 4. npm downloads the compromised package and may execute its lifecycle code with the maintainer's user privileges. 5. The maintainer then runs `clawhub login`; a compromised CLI can capture authentication material or misuse the authenticated session. 6. The malicious package can access resources available to that user and alter globally installed ...[truncated 486 chars]
- Remediation
- ## Remediation Suggestions - Remove maintainer-only publishing instructions from the runtime skill package when they are not needed for normal operation. - Pin the CLI to a specific reviewed version, for example `clawhub@<exact-version>`, and update it only through a controlled review process. - Use the package manager lockfile and integrity metadata where applicable, and verify the package against official ClawHub documentation and publisher identity. - Prefer a project-local, isolated installation over `npm i -g` to reduce system-wide impact. - Inspect package contents and lifecycle scripts before installation. Where compatible with the trusted installation procedure, disable lifecycle scripts using `--ignore-scripts`. - Run publishing operations from a restricted environment with minimal filesystem access and short-lived, least-privilege credentials. - Separate installation and authentication, and verify the installed executable's provenance before running `clawhub login`.