T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Unpinned and Unaudited npm Dependency## Vulnerability Details **File Location**: `SKILL.md:4` **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Medium **Vulnerable Code Snippet**: ```yaml metadata: {"openclaw": {"requires": {"bins": ["clawkeeper"], "env": ["CLAWKEEPER_DIR"]}, "primaryEnv": "CLAWKEEPER_DIR", "install": [{"id": "npm", "kind": "node", "package": "clawkeeper", "bins": ["clawkeeper"], "label": "Install via npm"}]}} ``` ### Technical Analysis The installation metadata directs the framework to install the `clawkeeper` package from npm without specifying an exact version, lockfile, integrity hash, immutable artifact reference, or other provenance constraint. Consequently, the code installed at deployment time may differ from the code originally reviewed. The dependency's implementation is not included in the audited project, which contains only `SKILL.md`. Its installation-time scripts and runtime behavior therefore could not be inspected. This does not establish that the current npm package is malicious, but it creates a supply-chain trust boundary that is not adequately controlled. Because the installed package provides the `clawkeeper` executable, its code runs with the permissions of the installing or invoking user. It also receives access to the environment and the location identified by `CLAWKEEPER_DIR`. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or another part of the publication process. 2. The attacker publishes a malicious or compromised release under the expected `clawkeeper` package name. 3. The Skill installation process resolves the package without an exact version or integrity restriction. 4. npm downloads and installs the attacker-controlled release. 5. Malicious code executes through an npm lifecycle script, if present and permitted, or when the installed `clawkeeper` executable is invoked. 6. The code operates with the invoking user's permissions and can acc ...[truncated 755 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `clawkeeper` to a reviewed, exact package version rather than allowing unconstrained resolution. 2. Lock and verify the package artifact using a cryptographic integrity hash. 3. Verify npm publisher identity and package provenance, and prefer signed or attestable releases from a trusted source. 4. Include the dependency source in the review scope or install it from a reviewed, immutable artifact or commit. 5. Disable npm lifecycle scripts during installation where they are unnecessary, then explicitly permit only reviewed setup steps. 6. Run the CLI with least privilege, limit access to `CLAWKEEPER_DIR`, avoid exposing unrelated secrets through environment variables, and restrict outbound network access where practical. 7. Add automated dependency monitoring and require security review before updating the pinned version.