T08 · Insecure Dependencies
Error
- Location
- SKILL.md:14
- Finding
- Official WeChat Plugin Replaced with an Unpinned Third-Party Fork## Vulnerability Details **File Location**: `SKILL.md`, lines 14-17 **Vulnerability Type**: Unpinned third-party dependency and unsafe supply-chain replacement **Risk Level**: High ### Vulnerable Code Snippet ```markdown 1. **判断微信渠道插件状态** - 运行 `openclaw plugins inspect openclaw-weixin --json`。 - 若已存在且 source 含 `clawbot-plugins` 或显示为 ClawBot fork 包：跳第 2 步。 - 若已装官方版（`@tencent-weixin/openclaw-weixin`）：先 `openclaw plugins uninstall openclaw-weixin`，再继续。 - 若未安装：`openclaw plugins install clawhub:@yechang1450/openclaw-weixin-clawbot`（内含引用 id 匹配与全文注入的微信渠道插件；请先征得用户同意）。 ``` The same replacement behavior is also documented in `README.md`, lines 9-12, and `README-zh.md`, lines 9-11. ### Technical Analysis The skill directs the agent to remove the official WeChat channel plugin and install the publisher-scoped third-party package `clawhub:@yechang1450/openclaw-weixin-clawbot`. The dependency is not pinned to an immutable version or integrity digest. Its source code is not included in the audited project, which contains only documentation and instructions. Consequently, the effective implementation loaded by the gateway may change after this skill has been reviewed. The fork operates in a sensitive message-processing position: according to the project documentation, it records server message identifiers, resolves quoted messages, and injects complete quoted message text into model context. A malicious or compromised dependency release could therefore process private chat content or execute other actions available to the OpenClaw plugin runtime. User consent before package installation is a useful safeguard against accidental replacement, but it does not verify package integrity, provenance, runtime permissions, data retention, or network behavior. ### Attack Path 1. An attacker compromises the third-party publisher account, package registry entry, release pipeline, or distribution source for `@yechang1450/openclaw-weixi ...[truncated 1783 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to a specific, reviewed version rather than installing a mutable package identifier. 2. Verify a cryptographic digest or signed provenance record before installation. 3. Publish or vendor the exact plugin source corresponding to the pinned release so its message handling, network behavior, storage, and command execution can be audited. 4. Verify the package publisher, registry namespace, build pipeline, and release signatures through an independent trust channel. 5. Request explicit informed consent immediately before both uninstalling the official plugin and installing the fork. Explain that the replacement processes message content. 6. Avoid removing the official plugin until the replacement has passed provenance and integrity checks. Provide a documented rollback procedure. 7. Run the plugin with least privilege, restricting filesystem access, environment variables, credentials, subprocess execution, and outbound network access to what is strictly required. 8. Document how message identifiers and quoted text are stored, retained, logged, and deleted. Avoid logging full message content. 9. Add automated checks that reject unexpected package versions, sources, signatures, or integrity hashes before restarting the gateway. 10. Prefer contributing the required quote-handling functionality to the official plugin or using an officially reviewed extension mechanism where possible.