T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:18
- Finding
- Unpinned Remote Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md:18-22` **Additional Location**: `README.md:33-37` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```markdown ### OpenClaw / Moltbot / Clawbot ```bash npx clawhub@latest install web-design ``` ``` ### Technical Analysis The installation instructions execute the mutable `latest` release of the `clawhub` npm package through `npx`. If that package is not already available locally, `npx` can download and execute it directly from the configured npm registry. The `latest` tag is mutable and does not identify the exact package version reviewed by the project author. No lockfile, integrity hash, checksum, or signature verification is provided. Consequently, the code that executes when a user follows these instructions can change after this Skill has been audited. This is a supply-chain weakness rather than evidence that the currently published package is malicious. ### Attack Path 1. An attacker compromises the `clawhub` npm package, its publisher account, or the associated registry distribution channel. 2. The attacker publishes a malicious release and assigns the mutable `latest` tag to it. 3. A user follows the documented installation command. 4. `npx` resolves `clawhub@latest`, downloads the attacker-controlled release, and runs its CLI or lifecycle behavior. 5. The malicious package executes with the operating-system privileges of the user running the installation. ### Impact Assessment Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on that account's permissions and environment, the malicious package could read or modify accessible files, steal developer credentials and environment variables, alter project content, install additional dependencies, or tamper with local development tools. The command itself does not request elevated privileges, so the direct privilege boundary is n ...[truncated 51 chars]
- Remediation
- ## Remediation Suggestions - Replace `@latest` with an exact, reviewed package version, such as `clawhub@X.Y.Z`. - Publish and verify the expected package integrity hash or cryptographic signature. - Document the trusted npm registry from which the package must be obtained. - Review the pinned package's lifecycle scripts, transitive dependencies, and CLI entry point before recommending execution. - Use a lockfile or another reproducible installation mechanism where supported. - Apply the same correction to the duplicate command in `README.md:33-37`. - Recommend running installation with a non-privileged account and without unnecessary secrets in the environment.