T08 · Insecure Dependencies
- Location
references/xhs-publish-flows.md:43- Finding
Unverified and Unpinned Third-Party Skill Installation
- Content
View full analysis
Vulnerability Details
File Location:
references/xhs-publish-flows.md:43-47
Vulnerability Type: Supply-chain risk from an unverified third-party dependency
Risk Level: MediumVulnerable Code Snippet
markdown ### 1.4 图文上传（外部生成封面） 适用于 Nano Banana / 外部工具先产图，再走图文发布的场景。 前置说明（提一句即可）：如未安装生图技能，可先执行 `clawhub install nano-banana-pro`。The relevant installation command is:
shell clawhub install nano-banana-proTechnical Analysis
The publishing workflow recommends installing the third-party
nano-banana-proSkill by package name alone. It does not:- Pin the dependency to a reviewed version or immutable digest.
- Identify or verify the expected publisher.
- Specify a trusted registry or repository.
- Require inspection of the downloaded package before loading it.
- Require explicit user authorization immediately before installation.
Consequently, the dependency resolved at installation time may differ from the component that was originally expected or reviewed. Dependency confusion, account compromise, package replacement, typosquatting, or a malicious future release could introduce attacker-controlled instructions or executable components.
This project contains no embedded malicious script, and the audit did not establish that
nano-banana-prois itself malicious. The vulnerability is the unsafe dependency-acquisition process.Attack Path
- An attacker publishes or compromises a package resolvable as
nano-banana-pro. - A user requests an externally generated cover as part of the publishing workflow.
- The Agent determines that the image-generation Skill is unavailable.
- Following the documented recommendation, the Agent or user executes:
shell clawhub install nano-banana-pro - The package manager resolves and installs the attacker-controlled or compromised release without validating a reviewed version, digest, or publisher.
- When the dependency is loaded or invoked, its instructions or code ...[truncated 1089 chars]
- Remediation
View remediation
Remediation Suggestions
-
Pin an immutable dependency
- Specify an audited version and, where supported, a cryptographic digest.
- Reject installation when the resolved artifact does not match the approved identity.
-
Verify package provenance
- Document the expected publisher, registry, and canonical package page.
- Require publisher-signature or package-signature verification where available.
- Prevent fallback to untrusted registries or similarly named packages.
-
Require explicit authorization
- Do not install the dependency automatically.
- Display the exact package identity, version, source, requested capabilities, and integrity value.
- Obtain explicit user confirmation immediately before installation.
-
Audit before execution
- Inspect the complete dependency contents, including instruction files, scripts, hooks, nested dependencies, and tool permissions.
- Scan for remote payload retrieval, secret access, persistence, unsafe shell execution, and unauthorized network destinations.
-
Apply least privilege and isolation
- Run image generation in a sandbox without credentials or authenticated browser state.
- Restrict filesystem access to dedicated input and output directories.
- Deny network access unless it is necessary and allowlisted.
- Do not expose publication controls to a component that only needs to generate an image.
-
Prefer a reviewed implementation
- Bundle a vetted image-generation integration or reference a centrally approved dependency manifest.
- Establish a controlled update process that requires re-audit before changing the pinned version.
-