T08 · Insecure Dependencies
- Location
SKILL.md:38- Finding
Unpinned Remote Skill Installation Creates a Supply-Chain Risk
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 38–42
Vulnerability Type: Unpinned third-party skill dependency
Risk Level: MediumVulnerable Code
markdown 安装规则： - 只有在用户明确同意后，才允许通过运行时的标准 ClawHub 安装流程安装这个精确的已审核 core skill： `clawhub install suka233/kmind-markdown-to-mindmap --workdir ./` - 不得替换成其他 slug，包括本地化变体。The same unpinned installation command is also documented in
README.md, lines 20–28, andREADME_zh_CN.md, lines 20–28.Technical Analysis
The wrapper directs the runtime to download and install a third-party skill using only the mutable ClawHub slug
suka233/kmind-markdown-to-mindmap. It does not pin an immutable version, commit identifier, or content digest. It also does not require signature or checksum verification after retrieval.Although the instructions require explicit user consent and describe the dependency as audited, consent only informs the user that an installation will occur. It does not establish that the artifact downloaded at installation time is the same artifact that was previously audited. The dependency source is not included in this repository, so its implementation and effective runtime behavior were outside the available audit scope.
Consequently, compromise of the publisher account, registry entry, distribution infrastructure, or a later release under the same slug could cause the wrapper to retrieve and delegate execution to code different from the reviewed version.
Attack Path
- An attacker compromises the ClawHub publisher account, registry record, or distribution channel associated with
suka233/kmind-markdown-to-mindmap. - The attacker publishes or substitutes a malicious skill artifact under the same mutable slug.
- A user invokes this wrapper in an environment where the core skill is not installed.
- The wrapper requests installation approval as required.
- The user approves the documented installation, believing that the referenced skill is the previously audi ...[truncated 1181 chars]
- An attacker compromises the ClawHub publisher account, registry record, or distribution channel associated with
- Remediation
View remediation
Remediation Suggestions
- Pin the dependency to an immutable reviewed release, commit identifier, or registry-supported content digest rather than installing by mutable slug alone.
- Require cryptographic signature or checksum verification before the downloaded skill is installed or invoked.
- Record the expected artifact digest and reviewed version in the repository so the runtime can reject substitutions.
- Show the user the resolved version, publisher identity, source, digest, and verification result before requesting approval.
- Fail closed if the registry cannot provide the exact pinned artifact or if integrity verification fails.
- Vendor the reviewed dependency into the distribution when licensing and platform constraints permit, then audit and release the wrapper and dependency as one immutable unit.
- If dynamic installation remains necessary, install into an isolated environment with only the filesystem and network permissions required for mind-map conversion.
- Re-audit every intentional dependency update before changing the pinned version or digest.