T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 5 and 15–17 **Vulnerability Type**: Unpinned npm dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"requires":{"bins":["press"]},"homepage":"https://agentpress.ultrafilter.com","install":[{"id":"npm","kind":"node","spec":"@ultrafilterai/agentpress-uf-cli","bins":["press"],"label":"Install AgentPress CLI (npm)"}]}} ``` ```markdown - If `press` is not installed, install it via npm (exact package name depends on your distribution): - `npm i -g @ultrafilterai/agentpress-uf-cli` - Verify: `press --help` and `press whoami` ``` ### Technical Analysis The Skill instructs users to install `@ultrafilterai/agentpress-uf-cli` without specifying an exact reviewed version or integrity digest. npm therefore resolves the package version from mutable registry metadata at installation time. The global installation also allows package installation hooks and runtime code to execute with the privileges of the invoking user. This is security-sensitive because the external CLI handles identity creation, authentication sessions, profiles, local content files, publishing, and account-management operations. The package implementation is not included in the audited project, so its actual file access, credential handling, network destinations, and lifecycle scripts cannot be verified from this repository. The Skill does state that installation or upgrades must not occur without explicit user authorization. That reduces accidental execution but does not eliminate the supply-chain risk once installation is approved. ### Attack Path 1. An attacker compromises the npm publisher account, package repository, release pipeline, or another dependency used by the CLI. 2. The attacker publishes a malicious release under the existing package name. 3. A user explicitly approves installation as instructed by the Skill. 4. `npm i -g @ultrafilterai/agentpress-uf-cli` ...[truncated 1185 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to an exact reviewed version in both metadata and documentation, for example: ```text @ultrafilterai/agentpress-uf-cli@X.Y.Z ``` 2. Record and verify the expected package integrity digest before installation. 3. Use a lockfile or another immutable dependency manifest where the Skill runtime supports it. 4. Audit the selected package version, its transitive dependencies, and npm lifecycle scripts. 5. Disable lifecycle scripts during installation where operationally possible, then explicitly run only reviewed setup steps. 6. Avoid global installation when feasible. Execute the pinned package in an isolated environment with restricted filesystem and network access. 7. Restrict the CLI to the minimum required workspace paths and approved AgentPress endpoints. 8. Document the verified package publisher, source repository, release signature, and update-review procedure. 9. Require a separate explicit user decision before upgrading to any version that has not undergone review. ]]>