T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:11
- Finding
- Unpinned Installation Sources Permit Supply-Chain Code Substitution## Vulnerability Details **File Location**: `SKILL.md`, lines 11-24 **Vulnerability Type**: Unpinned third-party dependencies and mutable installation sources **Risk Level**: Medium ```bash # Install all skills from repo npx skills add https://github.com/barneyjm/camino-skills # Or install specific skills npx skills add https://github.com/barneyjm/camino-skills --skill places ``` **Via clawhub:** ```bash npx clawhub@latest install places # or: pnpm dlx clawhub@latest install places # or: bunx clawhub@latest install places ``` ### Technical Analysis The documented installation commands obtain executable tooling and skill content from mutable external sources. The GitHub repository URL is not pinned to an immutable commit or signed release, while the ClawHub commands explicitly select the mutable `latest` package version. Package runners such as `npx`, `pnpm dlx`, and `bunx` download and execute package code in the installing user's environment. Consequently, the code executed by these commands can differ from the version reviewed during this audit. No evidence establishes that the current upstream packages are malicious; the vulnerability is the absence of version pinning and integrity verification. ### Attack Path 1. An attacker compromises the upstream repository, package registry account, maintainer credentials, or package publication process. 2. The attacker modifies the repository's default branch or publishes a malicious package version that becomes `latest`. 3. A user follows one of the documented installation commands. 4. The package runner retrieves the altered dependency or installer without validating it against an audit-approved commit or integrity digest. 5. Attacker-controlled installation or lifecycle code executes with the privileges of the user running the command. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the installing user's account. ...[truncated 434 chars]
- Remediation
- ## Remediation Suggestions - Pin the installation tool to a reviewed exact version instead of using `@latest`, for example `clawhub@X.Y.Z`. - Pin the GitHub source to an immutable, reviewed commit SHA or cryptographically signed release tag rather than the mutable default branch. - Publish and verify integrity hashes or signatures for both the installer and skill artifact before execution. - Use package-manager lockfiles where applicable and enforce integrity metadata during automated installation. - Document a verification procedure that checks the expected repository commit, package digest, and publisher identity. - Review lifecycle scripts and downloaded artifacts before executing installation commands, particularly in privileged or CI environments. - Avoid running package installers with administrative privileges and use a sandboxed or otherwise least-privileged environment.