T08 · Insecure Dependencies
- Location
scripts/install-all.sh:7- Finding
Unpinned Third-Party Skills Are Installed Without Interactive Confirmation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/install-all.sh:7-29
Vulnerability Type: Supply-chain exposure through unpinned and non-interactive dependency installation
Risk Level: Highbash # 定义 Skill 列表 SKILLS=( "zhang-yiming-perspective" "huang-zheng-perspective" "ma-huateng-perspective" "ren-zhengfei-perspective" "sequoia-investment-framework" "lei-jun-perspective" "wang-xing-perspective" "zhang-lei-perspective" "hillhouse-investment-framework" "bytedance-organization-framework" ) # 批量安装 for skill in "${SKILLS[@]}"; do echo "📦 安装 $skill ..." clawhub install "$skill" -y if [ $? -eq 0 ]; then echo "✅ $skill 安装成功" else echo "❌ $skill 安装失败" fi echo "" doneTechnical Analysis
The script installs ten third-party ClawHub skills using mutable package names. It does not pin package versions or immutable content digests, verify publisher identities or signatures, or validate the downloaded contents against known hashes.
The
-yoption disables interactive confirmation, so users cannot inspect or reject the resolved packages during execution. Consequently, the effective installed content may differ from the content that was reviewed in this repository. This creates a supply-chain trust boundary: security depends on the ClawHub registry, package maintainers, name resolution, and the current package versions returned at installation time.The repository itself does not contain a confirmed malicious payload. Exploitation requires one of the named external skills, its publisher account, or the associated distribution infrastructure to be compromised, substituted, or maliciously updated.
Attack Path
- An attacker compromises a publisher account, distribution path, or registry entry associated with one of the listed skill names, or otherwise causes a malicious package to resolve under that name.
- The attacker publishes a ...[truncated 1248 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin every external skill to an immutable, reviewed version and preferably a cryptographic content digest.
- Maintain a lock file or signed dependency manifest recording each package name, exact version, publisher identity, and expected hash.
- Require cryptographic signature verification and reject packages whose signer does not match an explicitly trusted publisher.
- Remove
-yfrom the default installation flow. Present the exact resolved version, publisher, requested permissions, and integrity information before installation. - Download dependencies into a quarantine or staging area and audit their instructions, scripts, manifests, and requested capabilities before activation.
- Fail closed if a package version, digest, signature, or publisher cannot be verified; do not silently continue to subsequent installations.
- Execute installed skills with least privilege, filesystem and network isolation, and narrowly scoped tool permissions.
- Add automated dependency monitoring and repeat the security review whenever a pinned dependency is intentionally upgraded.