T08 · Insecure Dependencies
Error
- Location
- skill.md:17
- Finding
- Unpinned Package Execution Through a Remotely Triggered Update Process## Vulnerability Details **File Location**: `skill.md:17-18`, `skill.md:27-30`, `skill.md:42`, and `skill.md:1375` **Vulnerability Type**: Unpinned executable dependency and remotely controlled update trigger **Risk Level**: High ### Vulnerable Code ```yaml install: - npx clawhub@latest install robodotfun ``` ```bash npx clawhub@latest install robodotfun ``` ```text At the start of every session, call `/agents/status`. The response includes a `skill_version` field — compare it to your current skill version (`1.1.0`). If they differ, re-run the install command above to update, then reload your skill context and proceed. ``` ```text Check for skill updates: Call `/agents/status` at session start — if `skill_version` differs from `1.1.0`, run `npx clawhub@latest install robodotfun` ``` ### Technical Analysis The skill instructs the agent to invoke `npx` with the mutable `latest` tag. `npx` may download and execute package code from the configured npm registry, while `latest` can resolve to a different package release at any time. No exact version, integrity digest, signature verification, lockfile, or reviewed artifact hash is specified. The update decision is also based on `skill_version` returned by the remote Robo Fun API. Consequently, the locally executed installation process can be initiated by remotely supplied state. The external API does not directly provide the executable payload, but a false or compromised version response can steer the agent into fetching and running the current registry package. This creates a time-of-review versus time-of-use supply-chain weakness: the code executed during a later installation may differ from the package version that was originally audited. Exploitation requires compromise or malicious control of a relevant trust dependency, such as the package publisher account, registry distribution path, package contents, or remote update response. ### Attack Path 1. An attacker compromises the `clawhub` package publi ...[truncated 1735 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the mutable package tag with an exact, reviewed version: ```bash npx --yes clawhub@X.Y.Z install robodotfun ``` Do not use `@latest`, version ranges, or other moving tags. 2. Verify package integrity before execution. Pin the expected registry integrity digest or validate a signed release artifact using a trusted public key. 3. Use a lockfile or equivalent immutable dependency manifest to pin transitive dependencies, not only the top-level package. 4. Separate update checking from update execution. A remote version mismatch should produce a notification rather than automatically cause local code execution. 5. Require explicit user or administrator confirmation before installing an update, and display the exact version, source, checksum, and requested changes. 6. Retrieve update metadata from a signed manifest and reject unsigned, invalid, downgraded, or unexpected releases. 7. Run installation in a restricted environment with minimal filesystem access, no unnecessary credentials, and no wallet or API secrets present. 8. Review and approve each new release before updating the pinned version in `skill.md`.