T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:17
- Finding
- Unpinned Third-Party Plugin Replaces the Official WeChat Plugin## Vulnerability Details **File Location**: `SKILL.md`, lines 17-20 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown 1. **判断微信渠道插件状态** - 运行 `openclaw plugins inspect openclaw-weixin --json`。 - 若已存在且 source 含 `clawbot-plugins` 或显示为 ClawBot fork 包：跳第 2 步。 - 若已装官方版（`@tencent-weixin/openclaw-weixin`，source 非 fork）：先 `openclaw plugins uninstall openclaw-weixin`（配置与登录态保留在 `.openclaw`，不受影响），再继续。 - 若未安装：`openclaw plugins install clawhub:@yechang1450/openclaw-weixin-clawbot`（内含 20s 防抖 + 引用注入的微信渠道插件；请先征得用户同意再执行安装）。 ``` ### Technical Analysis The Skill directs the agent to uninstall the official WeChat plugin and install `clawhub:@yechang1450/openclaw-weixin-clawbot`, a third-party fork, without specifying an immutable version or integrity digest. Package consent informs the user of the installation but does not verify the package's provenance or contents. The third-party plugin's source code is not included in the audited project. Consequently, its claimed debounce and quote-injection behavior, its requested permissions, and its handling of credentials and message data cannot be verified from this repository. Because the dependency is unpinned, the code resolved during a future installation may differ from the code reviewed or expected by the Skill author. ### Attack Path 1. A user invokes the Skill to enable WeChat message debouncing. 2. The agent inspects the installed plugin and detects the official package or no existing package. 3. If present, the agent removes the official WeChat plugin. 4. After obtaining installation consent, the agent resolves and installs the unpinned third-party ClawHub package. 5. An attacker who has compromised the publisher account, package registry, package distribution process, or a later package release supplies modified plugin code. 6. The Skill restarts the OpenClaw gateway, causing the downloaded plugin code t ...[truncated 920 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the third-party plugin to a specific, reviewed version rather than resolving the latest mutable release. 2. Verify the package with a cryptographic integrity digest or signed provenance metadata before installation. 3. Publish or reference the exact auditable source commit corresponding to the pinned package artifact. 4. Review the plugin's installation hooks, runtime behavior, requested permissions, credential access, message handling, and outbound network activity. 5. Prefer the official plugin when the required behavior can be implemented through supported configuration or an independently reviewable minimal extension. 6. Clearly disclose that the official plugin will be replaced, identify the third-party publisher, and explain the plugin's effective privileges before requesting consent. 7. Run the plugin under least privilege, restricting filesystem, credential, process, and network access to only what the debounce feature requires. 8. Preserve a verified rollback path to reinstall the official plugin if package verification, installation, or runtime validation fails.