T08 · Insecure Dependencies
Warning
- Location
- README.md:12
- Finding
- Unpinned Installation Commands Execute Mutable Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 12–18 **Vulnerability Type**: Supply-chain risk through unpinned npm tooling and mutable remote Skill content **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/setup-dca ``` Or via Clawhub: ```bash npx clawhub@latest install setup-dca ``` ### Technical Analysis The documented installation procedure invokes third-party npm tools through `npx` without pinning them to reviewed versions. The second command explicitly requests `clawhub@latest`, while the first retrieves Skill content from the mutable `main` branch of an external GitHub repository. Neither installation path specifies an immutable Git commit, package version, checksum, signature, or other integrity control. As a result, the dependencies and Skill content executed or installed by these commands may differ from the files reviewed during this audit. This creates a supply-chain trust boundary in which compromise of the relevant npm package, npm publisher account, GitHub repository, or repository maintainer account could replace legitimate installation behavior or Skill instructions with attacker-controlled content. ### Attack Path 1. An attacker compromises an upstream npm publisher account, the referenced GitHub repository, or a maintainer account. 2. The attacker publishes a malicious version of `clawhub` or `skills`, or modifies the Skill content on the repository's `main` branch. 3. A user follows the installation instructions and runs one of the documented `npx` commands. 4. `npx` resolves and executes the mutable third-party package under the user's local privileges, or installs the modified remote Skill. 5. Malicious installation code could access resources available to the invoking user. Alternatively, substituted Skill instructions could later abuse wallet-related tools when the Skill is activated. 6. Because the Skill's legitimate purpose ...[truncated 958 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every npm utility to a reviewed, exact version rather than relying on implicit resolution or `@latest`: ```bash npx clawhub@<reviewed-version> install setup-dca npx skills@<reviewed-version> add <source> ``` 2. Reference the Skill source using an immutable Git commit rather than the mutable `main` branch: ```text https://github.com/wpank/Agentic-Uniswap/tree/<full-commit-hash>/.ai/skills/setup-dca ``` 3. Publish expected cryptographic checksums or signed release artifacts and verify them before installation. 4. Use package-lock integrity metadata, provenance attestations, and npm signature or provenance verification where supported. 5. Advise users to download and inspect the package and Skill content before executing installation tooling, particularly in environments containing wallet credentials. 6. Run installation in a restricted environment with no wallet access, minimal filesystem permissions, and no unnecessary secrets in environment variables. 7. Establish a release process that reviews and signs each published Skill version, and document the exact audited version in the README. ]]>