T08 · Insecure Dependencies
Warning
- Location
- README.md:9
- Finding
- Unpinned Remote Dependencies in Documented Installation Commands## Vulnerability Details **File Location**: `README.md`, lines 9–15 **Vulnerability Type**: Supply-chain risk caused by mutable, unverified remote dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/design-hook ``` Or via Clawhub: ```bash npx clawhub@latest install design-hook ``` ### Technical Analysis The documented installation procedures direct users to retrieve and execute third-party npm tooling without immutable version pins or integrity verification. The first command retrieves skill content from the mutable `main` branch of a GitHub repository. The reviewed content can therefore differ from the content installed later. It also relies on the package that `npx` resolves for the `skills` command. The second command explicitly uses the mutable `latest` npm distribution tag. That tag may be reassigned to a different package release after this audit. Neither command specifies an expected checksum, package signature, commit SHA, or other immutable identity. This does not establish that the current packages or repository are malicious. However, it creates a supply-chain trust boundary in which later repository changes, package releases, tag reassignment, or compromise of a maintainer or registry account could alter the code executed during installation. ### Attack Path 1. An attacker compromises the relevant npm package, package maintainer, GitHub repository, or publishing credentials. Alternatively, an unsafe future release is published through the same mutable source. 2. The attacker changes the package version referenced by `latest`, modifies content on the repository's `main` branch, or injects malicious installer behavior into a remotely resolved dependency. 3. A user follows one of the installation commands from `README.md`. 4. `npx` downloads and executes the currently resolved third-party package rather than an im ...[truncated 996 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every npm command-line package to an exact, reviewed version instead of relying on implicit resolution or the `latest` tag. 2. Replace the GitHub `main` branch reference with an immutable commit SHA or a cryptographically signed release tag. 3. Publish and verify cryptographic checksums or signatures for downloaded skill artifacts. 4. Document the exact expected package versions and repository commit identifiers so users can reproduce the reviewed installation. 5. Recommend downloading and inspecting installation artifacts before execution, particularly when the installer can modify an agent's skill directory. 6. Avoid advising users to run installation commands with administrative privileges. 7. Use lockfiles, provenance attestations, and registry signature verification where supported. 8. Establish a controlled update process in which new package versions and repository revisions are reviewed before the documented pins are changed.