T08 · Insecure Dependencies
Error
- Location
- SKILL.md:30
- Finding
- Unaudited Remote Runtime Installed Through an Unsafe-Install Bypass## Vulnerability Details **File Location**: `SKILL.md:30-45` **Vulnerability Type**: Remote third-party runtime installed with elevated lifecycle access and local command-execution capabilities **Risk Level**: High The same installation guidance and security-sensitive capabilities are also documented in `README.md:8-39` and `references/README.md:8-39`. ### Vulnerable Code ```markdown Before installing, get explicit user confirmation. Tell the user what the install changes: - downloads the runtime plugin to `~/.openclaw/extensions/task-notifier/`; - enables `task-notifier` in OpenClaw plugin config; - adds it to `plugins.allow`; - grants lifecycle hook access with `allowConversationAccess`; - requires `--dangerously-force-unsafe-install` because the plugin intentionally runs local notification commands. The flag is a real security decision, not a cosmetic warning. The runtime plugin is designed to use local OS notification tools (`osascript` on macOS, PowerShell on WSL-on-Windows, and `notify-send` on Linux fallback), inspect the active foreground window title for suppression, and write small per-run state files under the active workspace's `.openclaw-task/` directory. The runtime itself does not need network access for notifications, but installing or updating from ClawHub uses network access. Privacy note: `allowConversationAccess` lets the runtime receive OpenClaw lifecycle hook context for conversations and agent turns. Task Notifier uses that context only to decide when a user-initiated agent run started/ended, identify the agent name, and avoid heartbeat/cron/system-event noise. Do not install it unless the user explicitly accepts persistent lifecycle hook access across agents. After explicit approval, install the runtime plugin: ```bash openclaw plugins install clawhub:task-notifier --dangerously-force-unsafe-install --force ``` ``` ### Technical Analysis The audited artifact contains documentation but do ...[truncated 3178 chars]
- Remediation
- ## Remediation Suggestions 1. **Include the runtime source in the audited artifact.** Bundle `src/index.js`, `src/index.ts`, `src/task-notify.sh`, installer scripts, diagnostics, manifest, and package metadata so reviewers can verify the executable behavior. 2. **Pin an immutable package identity.** Install a specific reviewed version and cryptographic digest rather than resolving a mutable package name. Verify the digest before enabling the plugin. 3. **Avoid the unsafe-install bypass.** Modify the plugin architecture to satisfy normal installation policy. If the bypass remains unavoidable, require an additional integrity check and display the exact pinned version and source digest before installation. 4. **Minimize lifecycle permissions.** Restrict hook data to the minimum fields needed to identify task start and completion. Avoid broad conversation access if a narrower event API is available. 5. **Constrain command execution.** Use fixed executable paths and fixed argument structures, reject untrusted input in notification titles and bodies, and avoid shell evaluation or dynamically constructed PowerShell commands. 6. **Apply least privilege and isolation.** Run notification handling in a restricted subprocess with limited filesystem access, no unnecessary network access, and no access to secrets or unrelated workspaces. 7. **Improve provenance verification.** Publish signed releases, document the source repository and build process, generate reproducible artifacts, and verify package signatures during installation and updates. 8. **Require approval for updates.** Do not automatically replace the reviewed runtime with newer remote code. Present permission or behavior changes and require renewed explicit consent. 9. **Provide complete cleanup.** Uninstallation should remove plugin configuration, allowlist entries, granted conversation access, installed runtime files, and residual `.openclaw-task` state after user confirmation.