T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:94
- Finding
- Unpinned Third-Party Skill Installation and Update Workflow## Vulnerability Details **File Location**: `SKILL.md`, lines 94-103 **Vulnerability Type**: Untrusted and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```markdown ## Related Skills Install with `clawhub install <slug>` if user confirms: - `documents` — General document handling and format conversion. - `brief` — Concise business writing and structured summaries. - `article` — Long-form drafting and editorial structure. ## Feedback - If useful: `clawhub star word-docx` - Stay updated: `clawhub sync` ``` ### Technical Analysis The Skill recommends installing registry-resolved third-party Skills using package slugs without specifying immutable versions, integrity hashes, verified publishers, or trusted repository locations. It also recommends `clawhub sync`, which may replace previously reviewed content with a newer mutable version. Requiring user confirmation before installation reduces the possibility of silent installation, but it does not establish the integrity or provenance of the selected package. If the registry, publisher account, package namespace, or update channel is compromised, the installed Skill could contain instructions or executable components outside the intended DOCX workflow. The project contains no executable scripts and no evidence that these commands run automatically. Exploitation therefore depends on a user following the installation or synchronization guidance and on the external dependency or distribution channel being compromised. ### Attack Path 1. An attacker compromises a referenced Skill publisher, registry entry, package namespace, or update channel. 2. The attacker publishes a malicious version under one of the recommended slugs or modifies a version distributed through synchronization. 3. A user follows the documented `clawhub install <slug>` or `clawhub sync` recommendation. 4. The unpinned, mutable content is downloaded without ...[truncated 922 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the third-party installation and synchronization recommendations unless they are necessary for the Skill’s core DOCX functionality. 2. Pin every recommended Skill to an exact, reviewed version rather than resolving only by a mutable slug. 3. Require cryptographic integrity verification, such as an approved package digest or signed release manifest. 4. Identify and verify the expected publisher and trusted registry source before installation. 5. Require users or administrators to inspect downloaded Skill instructions, scripts, and metadata before activation. 6. Avoid unrestricted `clawhub sync` in security-sensitive environments. Use an approval workflow that reviews version changes before deployment. 7. Maintain an allowlist of approved Skill names, versions, publishers, and hashes. 8. Run newly installed dependencies with least privilege and restrict filesystem, network, credential, and command-execution access.