T08 · Insecure Dependencies
Warning
- Location
- scripts/setup.sh:85
- Finding
- Unpinned Remote Plugin and Dependency Code Is Retrieved and Executed<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh:85-94` **Vulnerability Type**: Unverified third-party code and dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash if [ -d "$PLUGIN_DIR" ]; then echo "Plugin directory exists. Pulling latest..." cd "$PLUGIN_DIR" && git pull else git clone https://github.com/Shubhamsaboo/openclaw-vertexai-memorybank.git "$PLUGIN_DIR" cd "$PLUGIN_DIR" fi npm install npm run build ``` ### Technical Analysis The setup script clones or updates a remote Git repository without pinning it to a reviewed commit, release tag, or cryptographically verified artifact. The effective code installed by the Skill can therefore change after the Skill itself has been audited. The script subsequently runs `npm install`, which may execute npm package lifecycle scripts, and `npm run build`, which executes a script defined by the remotely retrieved repository. Neither the repository revision nor installed dependency artifacts are verified before execution. If the destination directory already exists, the script also trusts it without verifying its canonical path, configured Git remote, current branch, or repository ownership. A locally substituted repository at the expected path could therefore supply an attacker-controlled build script. This creates a supply-chain code-execution channel through: - Compromise or unauthorized modification of the upstream Git repository. - Force-pushing or changing the mutable default branch. - Compromise of a transitive npm dependency or its lifecycle scripts. - Replacement of the expected local plugin directory with a malicious Git repository. - Changes in dependency resolution when a reproducible, reviewed lockfile is not enforced with `npm ci`. ### Attack Path 1. An attacker compromises the upstream plugin repository, an npm dependency, or a maintainer account. Alternatively, the attacker prepares a malicious Git repository at `~/.openclaw/plugins/opencla ...[truncated 1476 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Pin the plugin source** - Check out an explicitly reviewed commit rather than the mutable default branch. - Verify that the checked-out commit exactly matches the expected hash. - Prefer signed release tags or signed commits and validate their signatures. 2. **Verify downloaded artifacts** - Publish versioned release archives with cryptographic checksums or signatures. - Store the expected checksum in the audited Skill and reject mismatches. 3. **Make dependency installation reproducible** - Require a reviewed and committed `package-lock.json`. - Replace `npm install` with `npm ci` so installation fails if the manifest and lockfile disagree. - Pin dependency versions and routinely audit direct and transitive packages. 4. **Restrict lifecycle scripts** - Initially install dependencies using `npm ci --ignore-scripts` where compatible. - Explicitly review and separately invoke only the lifecycle or build scripts required by the plugin. - Run installation and compilation in a sandbox or container with minimal filesystem, network, credential, and cloud access. 5. **Validate an existing plugin directory** - Resolve and validate the directory's canonical path. - Confirm that it is an actual Git repository owned by the expected user. - Verify its configured remote URL against an allowlist. - Fetch and check out only the pinned commit rather than invoking an unrestricted `git pull`. - Reject dirty working trees or unexpected local modifications. 6. **Minimize credentials during installation** - Do not expose active Google Cloud credentials to dependency installation or build processes unless strictly required. - Separate plugin compilation from cloud provisioning and execute the build in a restricted environment. ]]>