T08 · Insecure Dependencies
Warning
- Location
- scripts/publish_to_clawhub.sh:36
- Finding
- Unpinned Third-Party CLI Download and Execution via npx## Vulnerability Details **File Location**: `scripts/publish_to_clawhub.sh:36-44` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium **Complete Code Snippet**: ```sh echo "[1/3] 检查 ClawHub 登录态..." "${NPX_BIN}" -y clawhub whoami --no-input echo "[2/3] 发布 Skill..." "${NPX_BIN}" -y clawhub publish "${SKILL_DIR}" \ --slug "${SLUG}" \ --name "${NAME}" \ --version "${VERSION}" \ --tags "latest" \ --no-input ``` ### Technical Analysis The script invokes `npx` with `-y` and the unversioned package name `clawhub`. If the package is not already available in the local cache or installation, `npx` can automatically resolve, download, and execute the package without interactive confirmation. Because no exact package version, lockfile, or integrity hash is enforced, the code executed at publication time can differ from the code originally audited. This creates a supply-chain risk: a compromised package release, registry account, or unexpectedly incompatible future release could execute arbitrary package or lifecycle code under the invoking user's account. The process is particularly sensitive because the command operates within an authenticated ClawHub publishing context and receives the Skill directory as input. ### Attack Path 1. An attacker compromises the upstream `clawhub` package, its publisher account, or a subsequently resolved package release. 2. A user runs `scripts/publish_to_clawhub.sh`, either directly or through the persistent publisher job. 3. `npx -y clawhub` resolves and downloads the unpinned package without requesting confirmation. 4. The downloaded package or its lifecycle logic executes with the user's privileges. 5. Malicious code can inspect user-accessible files and environment data, misuse available ClawHub authentication, alter the project, or publish modified content. ### Impact Assessment Successful exploitation provides code execution w ...[truncated 508 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the CLI to a reviewed exact version, such as `clawhub@1.2.3`, rather than resolving the latest available release. 2. Prefer a preinstalled, trusted CLI and fail with explicit installation instructions if it is unavailable. 3. Remove `-y` so unexpected installation does not occur without user confirmation. 4. Manage the dependency through a committed lockfile and use a deterministic installation method such as `npm ci`. 5. Verify package provenance and registry integrity metadata before execution. 6. Run publishing from a restricted environment with only the files and credentials required for publication. 7. Regularly review and deliberately update the pinned version after validating its source and behavior.