T08 · Insecure Dependencies
Warning
- Location
- README.md:13
- Finding
- Unpinned npx Installers Allow Mutable Third-Party Code Execution<![CDATA[ ## Vulnerability Details **File Location**: `README.md:13-20`; `SKILL.md:15-18` **Vulnerability Type**: Unpinned third-party installation commands **Risk Level**: Medium ### Vulnerable Code `README.md:13-20`: ```bash # Add individual skills npx add https://github.com/wpank/ai/tree/main/skills/extraction/pattern-extraction ``` ```bash npx clawhub@latest install extraction ``` `SKILL.md:15-18`: ```bash npx clawhub@latest install extraction ``` ### Technical Analysis The documented installation procedures cause `npx` to download and execute third-party npm packages without pinning them to reviewed versions or integrity hashes. The `clawhub@latest` specifier explicitly resolves to a mutable future release. The `npx add ...` command similarly invokes an unpinned package named `add` to process content from a mutable GitHub branch. Consequently, the code executed during installation can differ from the code that existed when this Skill was audited. This creates a supply-chain trust boundary: compromise of a package publisher, npm package, dependency, GitHub repository, or upstream release process could turn the documented installation command into an arbitrary-code execution vector. The issue concerns installation-time behavior; no malicious runtime implementation was found inside the audited Skill files themselves. ### Attack Path 1. An attacker compromises the relevant npm package, publisher account, transitive dependency, or mutable upstream repository. 2. The attacker publishes a malicious release selected by `@latest`, modifies content on the referenced GitHub branch, or otherwise influences the unpinned installer. 3. A user follows the installation instructions and invokes the documented `npx` command. 4. `npx` downloads and executes the attacker-controlled package or installer code. 5. The malicious process runs with the permissions and environment inherited from the user who launched the command. ### Impact Assessment Successful exploi ...[truncated 671 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version: ```bash npx clawhub@X.Y.Z install extraction ``` 2. Pin remote repository content to an immutable commit hash rather than a mutable branch: ```text https://github.com/wpank/ai/tree/<reviewed-commit>/skills/extraction/pattern-extraction ``` 3. Avoid invoking the generic, unpinned `add` package. Use a verified and documented installer pinned to an exact version. 4. Where supported, verify package provenance, checksums, signatures, and npm integrity metadata before execution. 5. Use lockfiles and automated dependency scanning for any maintained installer environment. 6. Run installation with a least-privileged account in an isolated environment, without unnecessary secrets or production credentials. 7. Document the expected publisher, package identity, exact version, and integrity value so users can verify that they are installing the reviewed artifact. ]]>