T08 · Insecure Dependencies
Warning
- Location
- README.md:45
- Finding
- Unpinned Installation of Unrelated Third-Party Skills Through npx## Vulnerability Details **File Location**: `README.md`, lines 45-47 **Vulnerability Type**: Supply-chain exposure through unpinned third-party installation commands **Risk Level**: Medium **Vulnerable Code:** ```bash npx clawhub install openclaw-webnovel-writer npx clawhub install openclaw-memory-enhancer npx clawhub install openclaw-search-pro ``` ### Technical Analysis The documentation recommends running `npx clawhub` to install three unrelated third-party Skills. The commands do not pin an exact version of the npm package invoked by `npx`, verify package integrity or signatures, or identify audited versions of the installed Skills. Depending on the local npm configuration and cache state, `npx` can retrieve and execute package code from an external package registry. The effective code executed at installation time may therefore differ from the code reviewed in this project. The subsequently installed writing, memory, and search Skills are also outside this audit's scope and are not required for the declared UI-design functionality. This is a supply-chain risk rather than evidence that the referenced packages are currently malicious. Exploitation requires the user to follow the optional recommendations and a referenced package, distribution channel, account, or Skill release to be compromised or malicious. ### Attack Path 1. A user follows the recommendations in `README.md`. 2. `npx` resolves the unpinned `clawhub` package through the configured npm registry or package source. 3. The resolved package executes with the invoking user's privileges. 4. The command resolves and installs one or more third-party Skills that were not included in this audit. 5. If the npm package or an installed Skill is compromised, its installation or runtime behavior executes attacker-controlled logic. 6. That logic can access resources available to the user or Agent process, subject to operating-system and Agent sandbox restriction ...[truncated 729 chars]
- Remediation
- ## Remediation Suggestions 1. Remove recommendations to install unrelated Skills from this Skill's documentation. 2. Avoid invoking package-manager code through an unpinned `npx` command. Prefer a trusted, separately installed official CLI. 3. If `npx` is unavoidable, pin the CLI to an exact reviewed version and obtain it from an explicitly trusted registry. 4. Pin each recommended Skill to a specific audited release rather than resolving its latest mutable version. 5. Publish verified source locations, checksums, signatures, and maintainers for every recommended dependency. 6. Require users to review each third-party Skill's instructions, scripts, permissions, network behavior, and persistence behavior before installation. 7. Run installation in a least-privileged, isolated environment without access to credentials, sensitive files, or production Agent state. 8. Clearly label third-party recommendations as optional and outside the security scope of this package.