T08 · Insecure Dependencies
Error
- Location
- SKILL.md:6
- Finding
- External npm Packages Are Downloaded and Executed During Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:6`, `SKILL.md:32`, `SKILL.md:47-53`, and `SKILL.md:63-66` **Vulnerability Type**: Supply-chain code execution through externally retrieved npm packages **Risk Level**: High ### Vulnerable Code ```yaml installCommand: npx @wiimdy/openfunderse@2.0.0 install openfunderse-participant --with-runtime ``` ```markdown - Installing via `npx @wiimdy/openfunderse@2.0.0 ...` executes code fetched from npm. Prefer pinning a known version (as shown) and reviewing the package source before running in production. ``` ```bash npm init -y && npx @wiimdy/openfunderse@2.0.0 install openfunderse-participant --with-runtime ``` ```bash npx clawhub@latest install openfunderse-participant ``` ```bash npx @wiimdy/openfunderse@2.0.0 bot-init \ --skill-name participant \ --yes \ --no-restart-openclaw-gateway ``` ### Technical Analysis The project contains only `SKILL.md`; the implementation that performs installation, wallet initialization, environment synchronization, and runtime behavior is retrieved from npm and executed through `npx`. Consequently, the security-relevant implementation is outside the reviewed artifact. The scoped `@wiimdy/openfunderse` dependency is pinned to version `2.0.0`, which limits ordinary version drift but does not protect against registry compromise, maintainer account compromise, malicious transitive dependencies, or package-integrity substitution. The alternative `clawhub@latest` command is not pinned at all and can resolve to different code after this Skill has been reviewed. An npm CLI or lifecycle script executes with the invoking user's permissions. In this context, such code may be able to access the OpenClaw workspace, wallet files, `openclaw.json`, environment variables, and the participant private key. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, a transitive dependency, or the package-resolution channel. 2. The attacker publishes ...[truncated 1293 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every executable dependency, including ClawHub, to an exact reviewed version. Do not use `@latest`. 2. Verify package integrity with a trusted digest, signed provenance, or a reproducible artifact before execution. 3. Publish the runtime source with the Skill or link each release to an immutable source commit so the executed behavior can be audited. 4. Use a lockfile with integrity metadata and install from a controlled registry or reviewed offline package cache. 5. Run installation in a sandbox without wallet credentials, sensitive environment variables, or access to production OpenClaw configuration. 6. Separate installation from secret provisioning so downloaded package code never executes while production private keys are present. 7. Review package lifecycle scripts and transitive dependencies before production deployment. ]]>