T08 · Insecure Dependencies
Warning
- Location
- skill.md:18
- Finding
- Unpinned Third-Party Packages Are Installed and Executed Without Integrity Verification## Vulnerability Details **File Location**: `skill.md`, lines 18–27 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ```bash pip install mingjing ``` **Step 2** — Enable probe in OpenClaw: ```bash openclaw plugins install mingjing-probe openclaw config set plugins.entries.mingjing-probe.enabled true openclaw gateway ``` ### Technical Analysis The installation instructions retrieve the `mingjing` Python package and the `mingjing-probe` OpenClaw plugin without pinning immutable versions or verifying cryptographic hashes or signatures. The downloaded plugin is then explicitly enabled and loaded by starting the OpenClaw gateway. The audited project contains only `skill.md`; it does not include the source code of either installed component. Consequently, their behavior—including the document's claim that the software makes no outbound connections—cannot be verified from the submitted artifact. Package behavior may also change after this Skill has been reviewed because the commands resolve whichever package versions are available at installation time. This is a supply-chain weakness rather than evidence that the named packages are currently malicious. Exploitation would require compromise, replacement, dependency confusion, or publication of a malicious package version through a source trusted by the relevant package manager. ### Attack Path 1. An attacker compromises a package publisher, distribution account, registry entry, release process, or package-resolution source associated with `mingjing` or `mingjing-probe`. 2. The attacker publishes a modified package or plugin containing malicious initialization or runtime code. 3. A user follows `skill.md` and installs the package and plugin without an immutable version constraint or integrity check. 4. The package manager resolves and downloads the attacker-controlled release. 5. The user enables `mingjing-probe` and starts the OpenClaw gatew ...[truncated 854 chars]
- Remediation
- ## Remediation Suggestions 1. Pin both components to exact, reviewed versions rather than resolving the latest available releases. 2. Require cryptographic hashes for Python artifacts, such as through a locked requirements file and hash-enforced installation. 3. Use signed plugin artifacts and verify publisher identity and signatures before installation. 4. Document the authoritative registries and package ownership information to reduce dependency-confusion and typosquatting risk. 5. Include or link to source corresponding exactly to each pinned release so reviewers can audit the executed implementation. 6. Run the daemon, web panel, probe, and gateway under a dedicated least-privileged account with narrowly scoped filesystem and network permissions. 7. Document the plugin's required permissions, collected telemetry, storage locations, and network behavior. 8. Test the pinned artifacts for unexpected outbound traffic and package-installation side effects before publication.