T08 · Insecure Dependencies
Warning
- Location
- references/xhs-publish-flows.md:43
- Finding
- Unverified and Unpinned Third-Party Skill Installation## Vulnerability Details **File Location**: `references/xhs-publish-flows.md:43-47` **Vulnerability Type**: Supply-chain risk from an unverified third-party dependency **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ### 1.4 图文上传（外部生成封面） 适用于 Nano Banana / 外部工具先产图，再走图文发布的场景。 前置说明（提一句即可）：如未安装生图技能，可先执行 `clawhub install nano-banana-pro`。 ``` The relevant installation command is: ```shell clawhub install nano-banana-pro ``` ### Technical Analysis The publishing workflow recommends installing the third-party `nano-banana-pro` Skill by package name alone. It does not: - Pin the dependency to a reviewed version or immutable digest. - Identify or verify the expected publisher. - Specify a trusted registry or repository. - Require inspection of the downloaded package before loading it. - Require explicit user authorization immediately before installation. Consequently, the dependency resolved at installation time may differ from the component that was originally expected or reviewed. Dependency confusion, account compromise, package replacement, typosquatting, or a malicious future release could introduce attacker-controlled instructions or executable components. This project contains no embedded malicious script, and the audit did not establish that `nano-banana-pro` is itself malicious. The vulnerability is the unsafe dependency-acquisition process. ### Attack Path 1. An attacker publishes or compromises a package resolvable as `nano-banana-pro`. 2. A user requests an externally generated cover as part of the publishing workflow. 3. The Agent determines that the image-generation Skill is unavailable. 4. Following the documented recommendation, the Agent or user executes: ```shell clawhub install nano-banana-pro ``` 5. The package manager resolves and installs the attacker-controlled or compromised release without validating a reviewed version, digest, or publisher. 6. When the dependency is loaded or invoked, its instructions or code ...[truncated 1089 chars]
- Remediation
- ## Remediation Suggestions 1. **Pin an immutable dependency** - Specify an audited version and, where supported, a cryptographic digest. - Reject installation when the resolved artifact does not match the approved identity. 2. **Verify package provenance** - Document the expected publisher, registry, and canonical package page. - Require publisher-signature or package-signature verification where available. - Prevent fallback to untrusted registries or similarly named packages. 3. **Require explicit authorization** - Do not install the dependency automatically. - Display the exact package identity, version, source, requested capabilities, and integrity value. - Obtain explicit user confirmation immediately before installation. 4. **Audit before execution** - Inspect the complete dependency contents, including instruction files, scripts, hooks, nested dependencies, and tool permissions. - Scan for remote payload retrieval, secret access, persistence, unsafe shell execution, and unauthorized network destinations. 5. **Apply least privilege and isolation** - Run image generation in a sandbox without credentials or authenticated browser state. - Restrict filesystem access to dedicated input and output directories. - Deny network access unless it is necessary and allowlisted. - Do not expose publication controls to a component that only needs to generate an image. 6. **Prefer a reviewed implementation** - Bundle a vetted image-generation integration or reference a centrally approved dependency manifest. - Establish a controlled update process that requires re-audit before changing the pinned version.