T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:9
- Finding
- Unpinned and Unaudited Package Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:9`, `SKILL.md:20-23`, and `scripts/post-install.sh:8-10` **Vulnerability Type**: Unpinned third-party dependency and execution of installer code outside the audited artifact **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:9`: ```yaml metadata: {"openclaw":{"emoji":"🛒","requires":{"bins":["mcporter","curl","uv","python3"]},"envVars":[{"name":"AP2_HOME","required":true,"description":"Absolute path to AP2 repository root (directory containing code/)."},{"name":"MCPORTER_CONFIG","required":false,"description":"Path to this skill mcporter.json after ClawHub install."}],"install":[{"id":"mcporter","kind":"node","package":"mcporter","bins":["mcporter"],"label":"Install mcporter CLI"}]}} ``` From `SKILL.md:20-23`: ```bash cd "$AP2_HOME" npx -y file:code/samples/python/scenarios/a2a/unified/clawhub/npm/ap2-agent-checkout install ``` The same command is recommended by `scripts/post-install.sh:8-10`: ```bash echo "Recommended (skill + openclaw + auto-start mock backend):" echo " cd \"\$AP2_HOME\" && npx -y file:code/samples/python/scenarios/a2a/unified/clawhub/npm/ap2-agent-checkout install" ``` ### Technical Analysis The skill declares the npm package `mcporter` without an exact version or integrity constraint. Consequently, installation can resolve to a future package release that was not part of this audit. The recommended setup also invokes `npx` with `-y`, automatically consenting to package execution. The package is loaded from an AP2 working tree outside this audited skill artifact. The implementation and any npm lifecycle scripts in that directory were therefore not available for inspection during this audit. Although the `file:` source is local rather than an external URL, its trustworthiness depends on the provenance and current state of the separate AP2 checkout. If that checkout is compromised, replaced, or modified after review, `npx` may execute attacker-controlled package ...[truncated 1530 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `mcporter` to an exact, reviewed version rather than using an unconstrained package name. 2. Use a lockfile and verify npm package integrity hashes during installation. 3. Pin the AP2 repository to a reviewed commit and verify its commit signature or checksum before executing package code from it. 4. Include or vendor the installer implementation within the auditable project so its behavior and lifecycle scripts can be reviewed. 5. Remove `-y` from the recommended `npx` command so users receive an explicit execution prompt. 6. Prefer `npm ci` with a committed lockfile over dynamically resolving dependencies. 7. Disable or strictly review npm lifecycle scripts where feasible, for example by initially installing with `--ignore-scripts`. 8. Document every file, configuration entry, and process that the installer modifies or starts. 9. Run installation under a dedicated, least-privileged account and avoid using administrator or root privileges. ]]>