T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:21
- Finding
- Unpinned Third-Party Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 21–23 **Vulnerability Type**: Unpinned and unaudited third-party dependency execution **Risk Level**: Medium **Complete Code Snippet**: ```bash npx openclaw skill run agent-token-sentinel --cap 5.00 ``` ### Technical Analysis The documented usage instructs users to execute the `openclaw` npm package through `npx` without specifying an exact package version. Depending on the local environment and cache state, `npx` may retrieve the currently published package from the configured npm registry and execute its code. The project does not provide a lockfile, integrity hash, vendored implementation, trusted source reference, or other mechanism for verifying the package that will run. Consequently, the effective executable behavior is mutable and cannot be audited from the contents of this repository. The repository itself contains only `SKILL.md`; the advertised monitoring, loop detection, budget enforcement, and alert functionality is not implemented locally. Exploitation requires the package source or dependency chain to become malicious or resolve to an unintended artifact. Possible supply-chain scenarios include compromise of the publisher account, compromise of a transitive dependency, registry or configuration manipulation, or publication of an unexpectedly changed release. ### Attack Path 1. An attacker compromises the `openclaw` package, its publisher, one of its dependencies, or the registry resolution path used by the victim. 2. The attacker publishes or causes resolution to a malicious package version. 3. A user follows the usage instruction in `SKILL.md`. 4. `npx` resolves and downloads the unpinned package when an appropriate cached copy is unavailable. 5. The retrieved package code executes under the identity and permissions of the invoking user. 6. Malicious package code may access resources available to that user, subject to operating-system and enviro ...[truncated 536 chars]
- Remediation
- ## Remediation Suggestions - Pin `openclaw` to a specific, audited version rather than allowing `npx` to select the current registry release. - Commit an appropriate lockfile containing resolved versions and integrity metadata. - Verify package provenance and integrity before execution, and document the expected publisher, registry, and source repository. - Avoid automatic execution of remotely resolved packages. Prefer installing reviewed dependencies through a controlled build process and invoking the verified local binary. - Consider vendoring or including the actual skill implementation so its behavior can be reviewed with the repository. - Use a trusted private registry or dependency proxy with package allowlisting, malware scanning, and immutable artifacts. - Run the skill in a least-privileged, isolated environment without unnecessary credentials, sensitive filesystem access, or unrestricted network access. - Add automated dependency monitoring and require security review before updating the pinned version.