T08 · Insecure Dependencies
- Location
SKILL.md:5- Finding
Mutable Third-Party CLI Handles a Raw Wallet Private Key and Financial Transactions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 5 and 66–73
Vulnerability Type: Supply-chain exposure through an unpinned external npm package
Risk Level: HighVulnerable Code
yaml metadata: {"openclaw":{"emoji":"📊","always":false,"os":["darwin","linux"],"requires":{"bins":["node","npx"],"env":["PRIVATE_KEY"]},"primaryEnv":"PRIVATE_KEY","source":"https://github.com/wof-games/prediction-mcp","homepage":"https://watchorfight.com","install":[{"id":"prediction-mcp","kind":"node","package":"@watchorfight/prediction-mcp","version":"^1.3.5","bins":["wof-predict"],"label":"Install WatchOrFight Prediction CLI (npm)"}]}}bash npm install -g @watchorfight/prediction-mcptext | Variable | Required | Description | |---|---|---| | `PRIVATE_KEY` | Yes | Wallet private key (needs ETH for gas + USDC for stakes) | | `NETWORK` | No | `mainnet` (default) or `testnet` | | `RPC_URL` | No | Custom RPC endpoint |Technical Analysis
The Skill delegates all executable behavior to the external
@watchorfight/prediction-mcpnpm package. The metadata permits any semver-compatible release through^1.3.5, while the documented global installation command does not specify a version at all. Neither installation path provides an integrity hash or lockfile.This dependency operates in a particularly sensitive trust context: it receives the
PRIVATE_KEYenvironment variable, signs blockchain transactions, manages USDC approvals, and can transfer funds through prediction-market transactions. A newly published, compromised, or malicious package version could therefore access the wallet credential during installation or execution.The executable package source is not included in the audited artifact, so its network destinations, transaction construction, filesystem permissions, and handling of the private key cannot be independently verified. The static warning concerning sensitive network behavio ...[truncated 2198 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin the CLI to an exact reviewed version instead of using
^1.3.5or an unversioned installation command. - Supply and verify a package integrity hash or signed provenance before installation. Commit a lockfile where the deployment model permits it.
- Include the executable source in the reviewed artifact, or link the package to an immutable source commit and reproducible build.
- Audit all transitive dependencies and monitor the npm package for ownership changes and unexpected releases.
- Avoid global installation. Run the package in an isolated environment with restricted filesystem and network access.
- Disable npm lifecycle scripts where compatible with the package, or explicitly review every required install script.
- Replace direct raw-key access with a constrained signer, hardware wallet, delegated session key, or policy-controlled signing service. Enforce chain ID, approved contract addresses, token-spending caps, and transaction-value limits.
- Require explicit user confirmation for token approvals, transfers, market stakes, and identity-registration transactions. Display the destination, method, assets, and maximum value before signing.
- Continue requiring a dedicated wallet, but enforce low balances and narrowly scoped token allowances rather than relying only on documentation.
- Document the package's authorized network endpoints and ensure that private-key material is never included in requests, telemetry, logs, error reports, or analytics.
- Pin the CLI to an exact reviewed version instead of using