T08 · Insecure Dependencies
Warning
- Location
SKILL.md:143- Finding
Unpinned Third-Party Packages and Skills Can Execute Mutable Supply-Chain Payloads
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:143-157;references/skill-baseline.md:20-25;references/skill-baseline.md:110-141
Vulnerability Type: Unpinned and insufficiently verified third-party dependencies
Risk Level: MediumVulnerable Code
SKILL.md:143-157:bash npm i -g clawhubbash clawhub search "web search" clawhub install find-skill clawhub install openclawmp clawhub install markdownreferences/skill-baseline.md:20-25:markdown | Skill | Purpose | Source | |---|---|---| | `clawhub` | Search/install/update/publish skills | `npm i -g clawhub`; `clawhub install <skill>` | | `find-skill` | Skill search + local file search | ClawHub/local | | `openclawmp` | OpenClaw asset market guidance | local/market | | `markdown` | Markdown docs/memory/kb maintenance | ClawHub/local |references/skill-baseline.md:110-141:markdown ### nuwa-skill GitHub: ```text https://github.com/alchaincyf/nuwa-skillInstall:
bash npx skills add alchaincyf/nuwa-skilldarwin-skill
GitHub:
text https://github.com/alchaincyf/darwin-skillInstall:
bash npx skills add alchaincyf/darwin-skillBackup zip:
text https://pub-161ae4b5ed0644c4a43b5c6412287e03.r2.dev/skills/darwin-skill.ziptext ### Technical Analysis The Skill recommends global npm installation, execution through `npx`, and installation of third-party skills without pinning package versions, repository commit hashes, or artifact checksums. The stated confirmation requirement reduces accidental execution but does not establish the integrity of the software being approved. `npm i -g clawhub` resolves a mutable registry release and may execute npm lifecycle scripts with the invoking user's privileges. The `npx skills add ...` commands similarly invoke an unpinned package runner and retrieve mutable repository content. ...[truncated 2061 chars]- Remediation
View remediation
Remediation Suggestions
- Pin npm dependencies to explicitly reviewed versions, for example
clawhub@X.Y.Z, and commit an approved version list to the project. - Pin GitHub dependencies to immutable commit hashes rather than mutable default branches or repository names.
- Record and verify SHA-256 or stronger digests for downloaded archives and installed Skill packages.
- Require cryptographic signatures or provenance attestations where the package ecosystem supports them.
- Replace the informal name-based allowlist with a manifest containing the package name, publisher identity, approved version or commit, source URL, and expected digest.
- Audit package contents and lifecycle scripts before installation. Checking only for the presence of
SKILL.mdis insufficient. - Avoid global npm installation where possible. Prefer a locked, isolated project environment or disposable sandbox with least-privilege filesystem and network access.
- Configure
npxso it cannot silently obtain an unspecified latest package. Use an explicitly pinned package runner and prevent interactive fallback to arbitrary downloads. - Remove the opaque R2 archive fallback or publish its expected checksum through a separately controlled trusted channel.
- Run newly installed Skills in a restricted test environment before allowing access to user memory, credentials, protected files, or production workspaces.
- Pin npm dependencies to explicitly reviewed versions, for example