T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:62
- Finding
- Unpinned Installation of a Privileged Third-Party Plugin## Vulnerability Details **File Location**: `SKILL.md`, lines 62–76 **Vulnerability Type**: Unpinned third-party plugin and dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash openclaw plugins install @honcho-ai/openclaw-honcho ``` ```bash openclaw plugins enable openclaw-honcho ``` ```bash cd ~/.openclaw/extensions/openclaw-honcho && npm install ``` ### Technical Analysis The skill directs users to install and enable a third-party npm-based plugin without pinning a reviewed version, requiring package-integrity verification, or enforcing a lockfile. The fallback command also runs an unrestricted `npm install`, allowing npm to resolve the dependency graph available at installation time. Consequently, the code ultimately executed can differ from the version that existed when the skill was audited. This risk is significant because the plugin is intentionally granted access to workspace memory and agent-configuration files, stores an API key in `~/.openclaw/openclaw.json`, observes conversations, communicates with a network endpoint, and remains enabled across sessions. The documented behavior does not itself establish malicious intent. The vulnerability is the absence of controls protecting this privileged installation process from a compromised package release or transitive dependency. ### Attack Path 1. An attacker compromises `@honcho-ai/openclaw-honcho`, its publishing account, or one of its transitive dependencies. 2. The attacker publishes a malicious version or modifies a dependency selected by npm resolution. 3. A user follows the skill and installs the package without a version or integrity constraint. 4. The user enables the plugin, or runs the fallback `npm install`, causing the compromised code to become part of the OpenClaw extension. 5. The compromised plugin executes in the gateway context and can abuse the plugin's legitimate access to sensitive workspace content, configuration, conversations, credentials, and netwo ...[truncated 870 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@honcho-ai/openclaw-honcho` to a specific version that has been reviewed and tested. 2. Verify package integrity using an expected cryptographic digest or equivalent package-manager integrity control before enabling the plugin. 3. Document and verify the expected npm publisher, source repository, release provenance, and signing information. 4. Replace the unrestricted fallback `npm install` with a reproducible installation based on a reviewed lockfile, such as `npm ci` with a committed and verified lockfile. 5. Audit direct and transitive dependencies and enable automated monitoring for compromised, deprecated, or vulnerable releases. 6. Review the installed extension source before enabling it, especially code that reads workspace files, accesses configuration, registers conversation hooks, or performs network requests. 7. Install and run the plugin with the minimum filesystem and process privileges required. 8. Restrict outbound traffic to an explicitly approved HTTPS endpoint and reject insecure or unexpected destination URLs. 9. Provide rollback instructions that disable and remove the plugin if package integrity or publisher trust cannot be verified.