T08 · Insecure Dependencies
Error
- Location
- SKILL.md:22
- Finding
- Unpinned Third-Party Package Is Downloaded and Executed Automatically<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:22` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Complete Code Snippet ```text Install the AsterPay MCP server: npx -y @anthropic-ai/mcp-remote@latest https://x402-api-production-ba87.up.railway.app/mcp ``` ### Technical Analysis The installation instruction uses `npx -y` to download and execute an npm package without interactive confirmation. The mutable `@latest` tag does not identify a specific audited release, so the code executed by future installations can differ from the version available during this review. Although remote MCP connectivity is necessary for the declared service, executing an unpinned package is not the minimum privilege or trust required to establish that connection. A compromise of the npm publisher, package, or transitive dependency could introduce arbitrary code into the installation path. ### Attack Path 1. An attacker compromises the npm package publisher, package release process, or a transitive dependency. 2. The attacker publishes a malicious version under the `latest` tag. 3. A user follows the documented installation command. 4. `npx -y` retrieves the mutable release without prompting for approval. 5. Package lifecycle or runtime code executes with the privileges of the user running OpenClaw. 6. The malicious code can access files, environment variables, credentials, wallet-related configuration, and network resources available to that user. ### Impact Assessment Successful exploitation can result in arbitrary code execution under the invoking user's account. The accessible scope may include agent configuration, local documents, environment secrets, API credentials, and wallet integration data. The instruction does not itself grant administrator privileges, so impact is bounded by the permissions of the user executing `npx`. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions - Replace `@latest` with an exact, reviewed package version. - Use a lockfile and verify package integrity hashes before execution. - Remove `-y` where practical so package retrieval is visible to the user. - Document the expected package publisher, version, and checksum. - Prefer a project-local, locked dependency over ad hoc `npx` execution. - Run the MCP bridge in a restricted environment with minimal filesystem, environment-variable, and network access. - Establish a process for reviewing and deliberately updating the pinned version. ]]>