T08 · Insecure Dependencies
- Location
skill.md:17- Finding
Unpinned Package Execution Through a Remotely Triggered Update Process
- Content
View full analysis
Vulnerability Details
File Location:
skill.md:17-18,skill.md:27-30,skill.md:42, andskill.md:1375
Vulnerability Type: Unpinned executable dependency and remotely controlled update trigger
Risk Level: HighVulnerable Code
yaml install: - npx clawhub@latest install robodotfunbash npx clawhub@latest install robodotfuntext At the start of every session, call `/agents/status`. The response includes a `skill_version` field — compare it to your current skill version (`1.1.0`). If they differ, re-run the install command above to update, then reload your skill context and proceed.text Check for skill updates: Call `/agents/status` at session start — if `skill_version` differs from `1.1.0`, run `npx clawhub@latest install robodotfun`Technical Analysis
The skill instructs the agent to invoke
npxwith the mutablelatesttag.npxmay download and execute package code from the configured npm registry, whilelatestcan resolve to a different package release at any time. No exact version, integrity digest, signature verification, lockfile, or reviewed artifact hash is specified.The update decision is also based on
skill_versionreturned by the remote Robo Fun API. Consequently, the locally executed installation process can be initiated by remotely supplied state. The external API does not directly provide the executable payload, but a false or compromised version response can steer the agent into fetching and running the current registry package.This creates a time-of-review versus time-of-use supply-chain weakness: the code executed during a later installation may differ from the package version that was originally audited. Exploitation requires compromise or malicious control of a relevant trust dependency, such as the package publisher account, registry distribution path, package contents, or remote update response.
Attack Path
- An attacker compromises the
clawhubpackage publi ...[truncated 1735 chars]
- An attacker compromises the
- Remediation
View remediation
Remediation Suggestions
-
Replace the mutable package tag with an exact, reviewed version:
bash npx --yes clawhub@X.Y.Z install robodotfunDo not use
@latest, version ranges, or other moving tags. -
Verify package integrity before execution. Pin the expected registry integrity digest or validate a signed release artifact using a trusted public key.
-
Use a lockfile or equivalent immutable dependency manifest to pin transitive dependencies, not only the top-level package.
-
Separate update checking from update execution. A remote version mismatch should produce a notification rather than automatically cause local code execution.
-
Require explicit user or administrator confirmation before installing an update, and display the exact version, source, checksum, and requested changes.
-
Retrieve update metadata from a signed manifest and reject unsigned, invalid, downgraded, or unexpected releases.
-
Run installation in a restricted environment with minimal filesystem access, no unnecessary credentials, and no wallet or API secrets present.
-
Review and approve each new release before updating the pinned version in
skill.md.
-