T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:177
- Finding
- Unpinned ClawHub CLI Execution Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:177-188` **Additional Locations**: `SKILL.md:309-339`; `references/publish-workflow.md:51-77,87-93,117-122,156-193,204-221` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code Snippet ```bash # Verify auth npx clawhub whoami # Publish npx clawhub publish ./my-skill \ --slug my-skill \ --name "My Skill" \ --version 1.0.0 \ --changelog "Initial release" \ --tags latest # Check scanner results npx clawhub inspect my-skill ``` ### Technical Analysis The documentation repeatedly directs users to execute `clawhub` through `npx` without specifying a package version or requiring a previously installed and verified copy. When the package is unavailable locally, `npx` can retrieve and execute the package currently published under that name in the npm registry. Because no version or integrity value is pinned, the code executed by users may differ from the code reviewed when this skill was published. Executing the CLI is relevant to the skill's publishing functionality, but using a mutable package reference is not the minimum-risk mechanism. A compromised maintainer account, malicious package release, or upstream supply-chain compromise could turn these otherwise legitimate commands into a local code-execution vector. The separately flagged command in `references/script-safety.md:82`: ```bash curl -sL https://example.com/installer.sh | bash ``` is not an active vulnerability in this project. It appears only in a section explicitly labeled “Unsafe Patterns” and “BAD — downloads external code.” The project does not instruct users to execute that example. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, or its publication pipeline. 2. The attacker publishes a malicious version under the `clawhub` package name. 3. A user follows this skill's instructions and runs an unversioned command such as `npx cl ...[truncated 1300 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to a reviewed version in every executable example: ```bash npx --yes clawhub@VERIFIED_VERSION whoami npx --yes clawhub@VERIFIED_VERSION publish ./my-skill \ --slug my-skill \ --name "My Skill" \ --version 1.0.0 \ --changelog "Initial release" \ --tags latest ``` 2. Replace `VERIFIED_VERSION` with a specific audited release rather than a floating tag such as `latest`. 3. Prefer a separately installed, version-locked CLI managed through a lockfile. Instruct users to verify the installed version before authentication or publication. 4. Document the expected npm package identity, official source repository, publisher, and release verification procedure. 5. Where supported, verify package provenance, signatures, and registry integrity metadata before execution. 6. Apply the same pinned-version change to every `npx clawhub` command in `SKILL.md` and `references/publish-workflow.md`, including inspection, discovery, authentication, and publishing examples. 7. Recommend running initial package verification in a restricted environment without production credentials. Authenticate only after the package version and provenance have been validated. ]]>