T08 · Insecure Dependencies
Error
- Location
- SKILL.md:23
- Finding
- Unpinned External Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md:21-24` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: High **Vulnerable Code**: ```bash ## Usage ```bash npx openclaw skill run multi-exchange-hedge-core --all ``` ``` ### Technical Analysis The documented command invokes the external `openclaw` npm package through `npx` without specifying a package version, integrity hash, lockfile, or verified distribution source. If the package is unavailable locally, `npx` can retrieve it from the configured npm registry and execute its code with the invoking user's privileges. Consequently, the audited project does not determine the code that the user will execute. A compromised package release, registry account, package-resolution configuration, or unexpectedly changed latest version could introduce arbitrary behavior after this skill has been reviewed. The repository contains no local implementation with which to verify the advertised trading operations. ### Attack Path 1. An attacker compromises the `openclaw` package, its publisher account, or a package source selected by the user's npm configuration. 2. The attacker publishes or serves a malicious version containing installation-time or runtime code. 3. A user follows the documented command without having a trusted version installed locally. 4. `npx` resolves and downloads the unpinned package from the configured registry. 5. The downloaded package executes with the user's privileges. 6. The malicious package accesses resources available to that user, potentially including environment variables, local files, npm credentials, and exchange API credentials supplied for the advertised trading workflow. ### Impact Assessment Successful exploitation can provide arbitrary code execution under the account running the command. The attacker could read or modify files accessible to that account, steal environment variables and credentials, init ...[truncated 466 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to a specifically reviewed version, for example by using an exact package version rather than an unconstrained package name. 2. Commit a lockfile containing registry-resolved integrity metadata and perform installation with a lockfile-enforcing command such as `npm ci`. 3. Require users to install the verified package separately instead of allowing `npx` to download and execute an unresolved package implicitly. 4. Document the authoritative package publisher and registry source, and validate package provenance or signatures where supported. 5. Audit installation scripts and runtime code for the pinned release before recommending execution. 6. Prefer shipping an auditable local implementation with the skill so the executed code matches the reviewed artifact. 7. Run the trading process in a restricted environment with minimal filesystem and network access. 8. Use exchange API keys that prohibit withdrawals, limit trading permissions to required accounts and instruments, and apply IP allowlisting and position limits. 9. Avoid exposing unrelated secrets through environment variables or user-wide credential files during execution.