T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:164
- Finding
- Unpinned npm Package Execution Through a Mutable Tag## Vulnerability Details **File Location**: `SKILL.md`, lines 164–164 **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: Medium **Complete Code Snippet**: ```bash # Install via ClawHub npx clawhub@latest install md-bootstrap-optimizer ``` The same installation command is also advertised in the document metadata at `SKILL.md:6`. ### Technical Analysis The installation procedure uses `npx` to retrieve and immediately execute the npm package referenced by the mutable `latest` tag. No immutable package version or integrity digest is specified. Consequently, the code executed by this command may differ from the code available when the skill was audited. This creates a supply-chain trust boundary: successful exploitation requires an attacker to compromise or maliciously publish the `clawhub` package, one of its installation-time dependencies, or the relevant package distribution infrastructure. The reviewed file does not itself contain a malicious payload, and this finding does not establish that the current package is compromised. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, registry distribution path, or an installation-time dependency associated with `clawhub`. 2. The attacker publishes a malicious release and causes the mutable `latest` tag to resolve to it. 3. A user follows the documented `npx clawhub@latest install md-bootstrap-optimizer` instruction. 4. `npx` downloads and executes the attacker-controlled package in the user's environment. 5. The malicious package performs actions permitted by the invoking user's account, such as reading accessible files, modifying the OpenClaw workspace, installing additional payloads, or exfiltrating available credentials. ### Impact Assessment Exploited code would run with the privileges of the user invoking `npx`; the command does not independently demonstrate privilege escalation. The potent ...[truncated 313 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the mutable `latest` reference with a specific, reviewed package version, for example: ```bash npx clawhub@X.Y.Z install md-bootstrap-optimizer ``` 2. Document the expected package provenance and integrity metadata, and verify the downloaded artifact against a trusted digest or signed attestation before execution. 3. Review and pin transitive dependencies through the package's release and lockfile process. 4. Prefer a workflow that downloads and verifies the package before executing it rather than combining retrieval and execution in one command. 5. Run installation under an unprivileged account in a constrained environment, granting access only to the directories required for skill installation. 6. Update both occurrences of the command—`SKILL.md:6` and `SKILL.md:164`—to prevent users from following the unsafe variant.