T08 · Insecure Dependencies
Error
- Location
- SKILL.md:5
- Finding
- Unpinned Third-Party Package Handles Wallet Private Keys and Funds## Vulnerability Details **File Location**: `SKILL.md`, lines 5–33 **Vulnerability Type**: Unpinned and unverifiable third-party dependency with access to sensitive wallet credentials **Risk Level**: High ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"✊","always":false,"os":["darwin","linux"],"requires":{"bins":["node","npx"],"env":["PRIVATE_KEY"]},"primaryEnv":"PRIVATE_KEY","source":"https://github.com/wof-games/rps-mcp","homepage":"https://watchorfight.com","install":[{"id":"rps-mcp","kind":"node","package":"@watchorfight/rps-mcp","version":"^1.5.0","bins":["wof-rps"],"label":"Install WatchOrFight RPS CLI (npm)"}]}} ``` ```bash npm install -g @watchorfight/rps-mcp ``` ```markdown | Variable | Required | Description | |---|---|---| | `PRIVATE_KEY` | Yes | Wallet private key (needs ETH for gas + USDC for stakes) | ``` ### Technical Analysis The skill directs users to install `@watchorfight/rps-mcp` globally from npm without pinning the installed artifact to an exact, audited version and integrity digest. The metadata specifies the mutable semantic-version range `^1.5.0`, while the documented installation command omits a version entirely and can therefore retrieve the current registry release. The installed CLI is granted access to `PRIVATE_KEY`, a credential capable of signing blockchain transactions for the associated wallet. It is also expected to perform USDC approvals and value-bearing transactions. Consequently, this dependency occupies a highly sensitive trust position. The audited project contains only `SKILL.md`; it does not include the CLI source, a lockfile, an integrity hash, or verifiable provenance binding the npm artifact to a reviewed source commit. The referenced GitHub repository and recommendation to inspect it do not independently establish that the installed npm package corresponds to the reviewed source. ### Attack Path 1. An attacker compromises the npm publisher account, pack ...[truncated 1772 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an exact reviewed version rather than `^1.5.0`, and include that exact version in the documented installation command. 2. Verify the package with a trusted integrity digest and npm provenance before installation. Bind the published package to a reviewed source commit and reproducible build. 3. Include the relevant executable source in the audited project, or vendor a reviewed artifact, so its transaction and secret-handling behavior can be verified. 4. Avoid global installation where possible. Run the package in an isolated environment with minimal filesystem, network, and process privileges. 5. Avoid exposing a raw wallet private key through a broadly inherited environment variable. Prefer a hardware wallet, isolated signing service, or ephemeral signer that requires explicit approval. 6. Enforce signer-level restrictions: allowlist chain IDs and contract addresses, cap USDC approvals, reject unlimited approvals, simulate transactions, and require confirmation for every value-bearing operation. 7. Use a dedicated wallet containing only the minimum ETH and USDC required for a specific match. Do not reuse a wallet holding unrelated assets or privileged identities. 8. Add automated checks that reject unexpected package versions, provenance failures, contract destinations, transaction methods, approval amounts, and chain IDs before execution.