T03 · Remote Payload Retrieval and Execution
- Location
SKILL.md:28- Finding
Unpinned Remote Code and Dependency Execution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 28–37
Vulnerability Type: Mutable remote payload retrieval and insecure software supply chain
Risk Level: Mediumbash # Install npx clawhub install jiying # Start the server cd jiying && node server/index.js # Or development mode (including frontend UI) git clone https://github.com/Vane1981-2011/jiying.git cd jiying npm install npm run devTechnical Analysis
The documented installation procedures retrieve code from externally controlled, mutable sources and subsequently execute it without pinning or integrity verification.
The
npx clawhub install jiyingcommand does not identify an immutable package version or verified artifact digest. The alternative procedure clones the repository's current default branch rather than a specific audited commit. It then invokesnpm install, which resolves third-party packages and may execute package lifecycle scripts, followed bynpm run dev, which executes repository-defined commands.Consequently, the code ultimately executed can differ from the content available when this skill was reviewed. The artifact contains only
SKILL.md; it does not include the referenced application source, dependency lockfile, scripts, or server implementation. Therefore, the security claims and runtime behavior of the external implementation cannot be validated from the audited artifact.This finding does not establish that the current remote repository or package is malicious. It identifies a supply-chain execution path through which a future malicious update, compromised publisher account, compromised dependency, or altered default branch could introduce executable code after review.
Attack Path
- An attacker compromises the ClawHub package, its publisher account, the linked GitHub repository, or a resolved npm dependency. Alternatively, a maintainer unknowingly publishes a malicious or vulnerabl ...[truncated 1264 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin the installation to an immutable, reviewed release or full Git commit hash instead of the current default branch.
- Pin the ClawHub package to an exact version and document the expected publisher identity.
- Publish cryptographic checksums or signed release attestations and require verification before execution.
- Include a committed dependency lockfile and use
npm ciso dependency resolution is reproducible. - Initially install dependencies with lifecycle scripts disabled, such as
npm ci --ignore-scripts, and separately audit every lifecycle script that is genuinely required. - Audit the repository-defined
server/index.js,package.jsonscripts, transitive dependencies, and lockfile before recommending execution. - Run the application under a dedicated low-privilege account or isolated container with restricted filesystem and network access.
- Avoid exposing unrelated credentials to the process. Supply the DeepSeek API key through a narrowly scoped secret mechanism and rotate it if compromise is suspected.
- Bundle the reviewed implementation with the skill when feasible, allowing reviewers to assess the actual executed code rather than relying solely on external documentation.