T08 · Insecure Dependencies
Warning
- Location
README.md:55- Finding
Unpinned and Inconsistently Namespaced Skill Installation Sources
- Content
View full analysis
Vulnerability Details
File Location:
README.md, lines 55–64
Vulnerability Type: Supply-chain exposure through unverified and unpinned installation sources
Risk Level: MediumVulnerable Code
bash ## Install ```bash openclaw skills install @weilun88313/competitor-show-tracker --acknowledge-clawhub-riskSource install:
bash git clone https://github.com/LensmorOfficial/trade-show-skills.git cp -r trade-show-skills/competitor-show-tracker ~/.openclaw/skills/text ### Technical Analysis The documented installation methods do not pin an immutable package version, Git commit, integrity digest, or cryptographic signature. The registry command also uses the personal namespace `@weilun88313`, while the repository and stated project identity use `LensmorOfficial`. This identity mismatch makes it harder for users to verify that both distribution channels are controlled by the same trusted publisher. The registry installation additionally requires `--acknowledge-clawhub-risk`, indicating that a platform safety warning must be bypassed or explicitly accepted. The source installation clones the repository’s current default branch, so its effective contents may change after this audit without any corresponding change to the documented command. No malicious package or repository content was observed in the audited artifact. The vulnerability is the absence of controls ensuring that future installations reproduce the reviewed Skill. ### Attack Path 1. An attacker compromises, acquires, or impersonates the registry namespace or upstream repository. 2. The attacker publishes a modified Skill under the same mutable package name or updates the repository’s default branch. 3. A user follows the README and installs the latest available content without verifying a version, commit, signature, or checksum. 4. OpenClaw loads the substituted Skill instructions as trusted operational content. 5. Th ...[truncated 833 chars]- Remediation
View remediation
Remediation Suggestions
- Publish the Skill under a verified organization namespace consistent with the declared
LensmorOfficialidentity. - Pin registry installations to an immutable, reviewed version rather than implicitly installing the latest release.
- Pin source installations to a specific audited Git commit or signed release tag:
bash git clone https://github.com/LensmorOfficial/trade-show-skills.git cd trade-show-skills git checkout --detach AUDITED_COMMIT_HASH - Publish a SHA-256 checksum or cryptographic signature for each release and document verification before copying the Skill into the OpenClaw directory.
- Enable signed commits and protected release tags, and publish provenance linking the registry package to the corresponding repository commit.
- Remove the risk-acknowledgment requirement once publisher verification and package review requirements are satisfied. If it remains necessary, explain the specific warning and residual risks rather than encouraging users to accept it without verification.
- Run installed Skills with least privilege: expose only the required
LENSMOR_API_KEY, restrict network access to the documented Lensmor HTTPS host, and deny unrelated filesystem, process-execution, and environment-variable access.
- Publish the Skill under a verified organization namespace consistent with the declared