T08 · Insecure Dependencies
Error
- Location
- SKILL.md:16
- Finding
- Execution of Unpinned Third-Party Installer Code< after creating a passport there. __*OPTIONAL*__ From the repo (clone first): [github.com/aporthq/aport-agent-guardrails](https://github.com/aporthq/aport-agent-guardrails) — then run `./bin/openclaw` or `./bin/openclaw <agent_id>` from the repo root. ``` ### Technical Analysis The documented installation procedures execute externally maintained code without pinning it to an exact package version, immutable source commit, integrity hash, or cryptographically signed release. Running `npx @aporthq/agent-guardrails` resolves and executes the package version selected by the npm registry at installation time. Consequently, the code executed by a user can differ from the code that existed when this Skill was reviewed. The alternative GitHub workflow similarly tells users to clone the repository and execute `./bin/openclaw` without identifying a reviewed commit or release. This creates a supply-chain trust boundary in which compromise of the npm publisher account, registry distribution path, GitHub account, repository, or installer release process could cause arbitrary attacker-controlled code to execute. The project contains only `SKILL.md`, so the actual installer, plugin, and wrapper implementations are not available locally for verification. The behavior is not, by itself, proof that the external package is malicious. The vulnerability is that the instructions provide no mechanism to guarantee that the remotely obtained code is the same code that was audited. ### Attack Path 1. An atta ...[truncated 1799 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the npm command to an exact reviewed version: ```bash npx --yes @aporthq/agent-guardrails@<exact-version> ``` Do not use version ranges or mutable tags such as `latest`. 2. Publish and document a cryptographic integrity value for the package artifact. Verify its checksum or signature before execution. 3. For the GitHub installation path, require checkout of an immutable reviewed commit: ```bash git clone https://github.com/aporthq/aport-agent-guardrails.git cd aport-agent-guardrails git checkout --detach <reviewed-full-commit-hash> ``` 4. Prefer signed release tags and document how users must verify the signature against a separately published, trusted maintainer key. 5. Vendor the installer and security-sensitive wrapper code in the Skill package where practical, allowing the complete execution path to be audited together with `SKILL.md`. 6. Publish package lockfiles, provenance attestations, software bills of materials, and reproducible-build information. 7. Run installation with the least-privileged account necessary. Explicitly warn users not to execute the installer as root or an administrator unless that privilege is demonstrably required. 8. Document every file, plugin, wrapper, configuration entry, and network endpoint created or accessed by the installer so users can verify the resulting installation. ]]>