T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:20
- Finding
- Unpinned External Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 20-23 **Vulnerability Type**: Unpinned and unverifiable third-party dependency execution **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown ## Usage ```bash npx openclaw skill run agent-audit-shield --hardened ``` ``` ### Technical Analysis The documented usage command executes `openclaw` through `npx` without specifying an exact package version, integrity hash, lockfile, or verified source. Depending on the local environment and package cache, `npx` may download executable package content from an external package registry at invocation time. The audited project contains only `SKILL.md`; it does not include the interceptor, scanner, approval interface, or safeguards described in the documentation. Consequently, the effective implementation is external to the reviewed artifact and can differ from the code that was originally assessed. A compromised upstream release, package-name takeover, registry compromise, or malicious future update could therefore cause arbitrary package code to run when a user follows the documented command. This is primarily an insecure software supply-chain dependency rather than evidence that the current upstream package is malicious. ### Attack Path 1. An attacker compromises the package publisher, registry account, distribution channel, or another externally resolved component. 2. The attacker publishes a malicious version under the package name resolved by `npx`, or alters externally resolved skill content. 3. A user follows the documented usage command without an explicit version or integrity constraint. 4. `npx` retrieves or selects the attacker-controlled package version. 5. Package lifecycle logic or the invoked command executes with the permissions of the user running `npx`. 6. The malicious code can access resources available to that user, including local files, environment variables, credentials exposed to ...[truncated 564 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `openclaw` to an exact, reviewed version rather than relying on an unqualified package name. 2. Maintain and distribute a lockfile containing registry-resolved integrity metadata. 3. Document the authoritative package registry and source repository so users can verify provenance. 4. Verify package signatures or cryptographic hashes before execution where supported. 5. Disable or carefully review package lifecycle scripts and transitive dependencies. 6. Bundle the actual skill implementation in the audited artifact, or provide immutable references to all externally executed components. 7. Run the package in a sandbox or container with minimal filesystem access, restricted environment variables, limited network access, and no elevated privileges. 8. Ensure the documented security claims are supported by auditable implementation and automated tests.