T08 · Insecure Dependencies
- Location
scripts/publish_to_clawhub.sh:36- Finding
Unpinned Third-Party CLI Download and Execution via npx
- Content
View full analysis
Vulnerability Details
File Location:
scripts/publish_to_clawhub.sh:36-44
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: MediumComplete Code Snippet:
sh echo "[1/3] 检查 ClawHub 登录态..." "${NPX_BIN}" -y clawhub whoami --no-input echo "[2/3] 发布 Skill..." "${NPX_BIN}" -y clawhub publish "${SKILL_DIR}" \ --slug "${SLUG}" \ --name "${NAME}" \ --version "${VERSION}" \ --tags "latest" \ --no-inputTechnical Analysis
The script invokes
npxwith-yand the unversioned package nameclawhub. If the package is not already available in the local cache or installation,npxcan automatically resolve, download, and execute the package without interactive confirmation.Because no exact package version, lockfile, or integrity hash is enforced, the code executed at publication time can differ from the code originally audited. This creates a supply-chain risk: a compromised package release, registry account, or unexpectedly incompatible future release could execute arbitrary package or lifecycle code under the invoking user's account.
The process is particularly sensitive because the command operates within an authenticated ClawHub publishing context and receives the Skill directory as input.
Attack Path
- An attacker compromises the upstream
clawhubpackage, its publisher account, or a subsequently resolved package release. - A user runs
scripts/publish_to_clawhub.sh, either directly or through the persistent publisher job. npx -y clawhubresolves and downloads the unpinned package without requesting confirmation.- The downloaded package or its lifecycle logic executes with the user's privileges.
- Malicious code can inspect user-accessible files and environment data, misuse available ClawHub authentication, alter the project, or publish modified content.
Impact Assessment
Successful exploitation provides code execution w ...[truncated 508 chars]
- An attacker compromises the upstream
- Remediation
View remediation
Remediation Suggestions
- Pin the CLI to a reviewed exact version, such as
clawhub@1.2.3, rather than resolving the latest available release. - Prefer a preinstalled, trusted CLI and fail with explicit installation instructions if it is unavailable.
- Remove
-yso unexpected installation does not occur without user confirmation. - Manage the dependency through a committed lockfile and use a deterministic installation method such as
npm ci. - Verify package provenance and registry integrity metadata before execution.
- Run publishing from a restricted environment with only the files and credentials required for publication.
- Regularly review and deliberately update the pinned version after validating its source and behavior.
- Pin the CLI to a reviewed exact version, such as