T08 · Insecure Dependencies
Warning
- Location
- README.md:9
- Finding
- Unpinned Remote Installation Dependencies## Vulnerability Details **File Location**: `README.md`, lines 9 and 15 **Vulnerability Type**: Unpinned third-party installation tools and mutable remote Skill content **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/analyze-pool ``` ```bash npx clawhub@latest install analyze-pool ``` ### Technical Analysis The documented installation commands retrieve and execute npm-delivered tooling without pinning it to reviewed versions. The second command explicitly selects the mutable `latest` release of `clawhub`. The first command also installs Skill content from a mutable GitHub branch path instead of an immutable commit. Consequently, the components and Skill instructions installed by these commands can change after this audit. A compromise of an npm package, package-publishing account, registry resolution process, GitHub repository, or upstream maintainer account could replace the expected installer or Skill content with attacker-controlled material. The vulnerable behavior is not triggered merely by loading the two audited Markdown files. Exploitation requires a user to follow one of the documented installation commands. ### Attack Path 1. An attacker compromises the relevant npm publishing account, GitHub repository, upstream maintainer account, or another component in the distribution chain. 2. The attacker publishes a malicious package version or modifies the Skill content referenced by the mutable branch. 3. A user runs one of the installation commands from `README.md`. 4. `npx` resolves and executes the unpinned installer package, which may retrieve the modified remote Skill content. 5. Attacker-controlled installer behavior executes with the permissions of the invoking user, or malicious Skill instructions are installed and later loaded by the agent. ### Impact Assessment A malicious npm installer may execute arbitrary actions ...[truncated 590 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every npm CLI package to an exact, reviewed version rather than using `@latest` or an implicit current version. 2. Replace the mutable GitHub branch URL with a reference to a reviewed commit hash or immutable signed release tag. 3. Verify downloaded artifacts using checksums, provenance attestations, or cryptographic signatures before installation. 4. Use npm lockfiles and integrity metadata where the installation workflow supports them. 5. Document the expected package publisher, version, source commit, and integrity value so users can validate the installation. 6. Run installation in a restricted environment without unnecessary credentials or elevated privileges. 7. Establish an update process in which new package versions and source commits are reviewed before the pinned references are changed.