T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:17
- Finding
- Unpinned ClawHub Installer Can Execute Mutable Third-Party Code## Vulnerability Details **File Location**: `SKILL.md:17-20` **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium **Vulnerable Code**: ```bash ### OpenClaw / Moltbot / Clawbot ```bash npx clawhub@latest install subagent-development ``` ``` ### Technical Analysis The installation instructions invoke `clawhub` through `npx` using the mutable `@latest` version tag. Unlike an exact, reviewed package version, `@latest` can be changed by the package publisher after this Skill has been audited. Because `npx` retrieves and executes package code, compromise of the package publisher account, registry package, or upstream release process could cause future users to execute attacker-controlled code. The effective installer payload is therefore not fixed to the content reviewed in this audit. This is a supply-chain weakness rather than evidence that the current upstream package is malicious. ### Attack Path 1. An attacker compromises the `clawhub` package, its publisher account, or its release pipeline. 2. The attacker publishes a malicious package version and assigns it the `latest` distribution tag. 3. A user follows the documented command: `npx clawhub@latest install subagent-development`. 4. `npx` retrieves the attacker-controlled version from the package registry. 5. The malicious package executes with the permissions of the user running the installation. 6. Depending on those permissions, the payload could modify project files, access user-readable data, tamper with installed Skills, or run additional local commands. ### Impact Assessment Successful exploitation provides code execution with the privileges of the user who runs the installation command. For a normal developer account, the scope could include source repositories, user configuration, accessible credentials, and other files owned by that user. If the command is run from an elevated shell or privileged automation environment, the impact could extend to sy ...[truncated 178 chars]
- Remediation
- ## Remediation Suggestions - Replace `@latest` with an exact, reviewed package version, for example `clawhub@X.Y.Z`. - Use a lockfile or equivalent integrity mechanism where the installation environment supports one. - Verify the package checksum, registry provenance, and publisher identity before execution. - Document a controlled upgrade process in which new versions are reviewed before the pinned version is changed. - Prefer downloading and inspecting installation tooling before execution in sensitive environments. - Advise users not to run installation commands with elevated privileges unless explicitly required.