T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:3
- Finding
- Unpinned Third-Party npm Package Executes Unreviewed Code## Vulnerability Details **File Location**: `SKILL.md`, lines 3 and 13 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"🖼️","requires":{"bins":["clawvisual"]},"install":[{"id":"npm","kind":"npm","package":"clawvisual","bins":["clawvisual"],"label":"Install clawvisual (npm)"}]}} ``` ```bash npm install -g clawvisual ``` ### Technical Analysis The Skill installs the third-party `clawvisual` npm package without specifying an exact version or integrity hash. The package's source code, package manifest, and lockfile are not included in the audited project, so its installation hooks and runtime behavior cannot be verified from the available artifact. Running `npm install -g clawvisual` resolves whichever package version is current under that npm package name. npm packages may execute package-controlled lifecycle scripts during installation and install executable commands. The global installation scope also makes the resulting command available outside this individual Skill invocation. This creates a supply-chain exposure: a compromised maintainer account, malicious package release, or unexpected future package update could alter the code executed by users without requiring any change to `SKILL.md`. The documentation later directs users to provide API keys to this unaudited executable, increasing the potential sensitivity of a compromised dependency. The audit found no evidence that the current package is malicious. The issue is the Skill's unpinned and unverifiable trust in an externally maintained executable dependency. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, or its release process and publishes a malicious version under the `clawvisual` package name. 2. A user or Agent follows the installation instruction in `SKILL.md`: ```bash npm install -g clawvisual ``` 3. npm resolves ...[truncated 1159 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an exact, reviewed version rather than resolving the latest release: ```bash npm install --global clawvisual@<reviewed-exact-version> ``` 2. Record and verify the expected package integrity digest through a lockfile or an equivalent trusted verification mechanism. 3. Prefer a project-local installation over a global installation to reduce command replacement and cross-project exposure. 4. Review and retain the source code and package metadata corresponding to the pinned release. 5. Disable npm lifecycle scripts during installation with `--ignore-scripts` unless they are demonstrably required. If scripts are required, audit each script before permitting execution. 6. Pin the package by immutable artifact or commit and establish a controlled update process requiring security review. 7. Document the expected network endpoints, local credential-storage behavior, and file permissions used by the CLI. 8. Store API keys using an operating-system credential manager or another protected secret store rather than plaintext configuration, if supported. 9. Run the CLI with least privilege and restrict filesystem and network access where practical.