T08 · Insecure Dependencies
Error
- Location
- SKILL.md:6
- Finding
- Unpinned Third-Party Dependency Handles Wallet Credentials and Payment Operations<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:6-12` **Additional Locations**: `SKILL.md:55-61`, `metadata.json:20-28`, `examples/check_balance.py:4,10`, `examples/create_invoice.py:4,10`, `examples/pay_invoice.py:4,10-12` **Vulnerability Type**: Unpinned and unauditable security-critical dependency **Risk Level**: High ### Vulnerable Code ```yaml metadata: openclaw: requires: bins: - pip install: - kind: uv package: nostrwalletconnect bins: [] ``` The installation documentation similarly installs the latest resolvable release without a version or integrity constraint: ```bash pip install nostrwalletconnect ``` The package metadata also lacks an exact package version and allows later `nostrkey` releases: ```json "install": { "pip": "nostrwalletconnect" }, "requires": { "python": ">=3.10" }, "dependencies": [ "nostrkey>=0.1.1" ] ``` The external package is then trusted with wallet credentials and payment operations: ```python from nostrwalletconnect import NWCClient NWC_URI = "nostr+walletconnect://<wallet_pubkey>?relay=wss://relay.example.com&secret=<hex_secret>" async def main(): async with NWCClient(NWC_URI) as nwc: result = await nwc.pay_invoice("lnbc10u1p...") print(f"Payment successful! Preimage: {result.preimage}") ``` ### Technical Analysis The project installs `nostrwalletconnect` without an exact version or cryptographic hash. Its declared `nostrkey>=0.1.1` dependency also accepts any compatible later release. Neither dependency's implementation is included in the audited project. Consequently, the code installed in a future environment may differ from the code that existed when this skill was reviewed. This is particularly security-sensitive because `NWCClient` receives an NWC connection URI containing a secret authorization key, opens external relay connections, reads wallet information, and can submit irreversible Lightning payment requests. This ...[truncated 1982 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `nostrwalletconnect` and every transitive dependency to reviewed, exact versions. 2. Generate and commit a lock file appropriate to the installer being used. 3. Require cryptographic artifact hashes during installation, such as with a hash-locked requirements file and `pip --require-hashes`. 4. Include or vendor the security-critical client implementation when feasible so its behavior can be audited alongside the skill. 5. Verify package publisher identity, release provenance, signatures, and build artifacts before upgrades. 6. Introduce a controlled dependency-update process that includes source review, automated vulnerability scanning, and wallet-operation regression tests. 7. Configure the NWC connection with least privilege: permit only required NIP-47 methods, impose per-payment and cumulative spending limits, and use a wallet containing only necessary funds. 8. Require explicit operator approval for payments above a defined threshold. 9. Rotate and revoke the NWC connection immediately if dependency compromise is suspected. 10. Update the examples to load the URI from `NWC_CONNECTION_STRING` rather than encouraging users to place a credential in source code. ]]>