T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:27
- Finding
- Unpinned Third-Party Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27–28; related package declaration at line 15 **Vulnerability Type**: Unpinned and unverified third-party dependency **Risk Level**: Medium ### Vulnerable Code ```bash pip install neural-memory nmem init ``` The related metadata declares the same package without an exact version or integrity constraint: ```yaml metadata: {"openclaw":{"emoji":"brain","primaryEnv":"NEURALMEMORY_BRAIN","requires":{"bins":["python3"],"env":["NEURALMEMORY_BRAIN"]},"os":["darwin","linux","win32"],"install":[{"id":"pip","kind":"node","package":"neural-memory","bins":["nmem"],"label":"pip install neural-memory"}]}} ``` ### Technical Analysis The installation command resolves and installs the current `neural-memory` package from the user's configured Python package index. The Skill does not pin an audited version, verify package hashes, provide a lockfile, or bundle reviewable implementation code. The subsequent `nmem init` command executes code supplied by the installed package. According to the documentation, this initialization creates files under `~/.neuralmemory/` and configures MCP automatically. Because the package implementation is not included in the audited artifact, the actual behavior of installation hooks and initialization code cannot be verified here. This creates a supply-chain trust boundary: the effective executable code may change after this Skill has been reviewed. A compromised package release, maintainer account, transitive dependency, package index, or index configuration could cause arbitrary code to execute under the installing user's account. ### Attack Path 1. An attacker compromises the `neural-memory` package, one of its dependencies, its publishing account, or a package source used by the victim. 2. The attacker publishes a malicious package version that remains compatible with the unpinned package name. 3. A user follows the Skill instructions and runs `pip install neural-me ...[truncated 1187 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specifically reviewed release, for example: ```bash python3 -m pip install neural-memory==<reviewed-version> ``` 2. Require package integrity verification using hashes: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` Maintain a reviewed requirements or lock file containing exact versions and SHA-256 hashes for the package and all transitive dependencies. 3. Link the Skill release to the exact source commit and package artifact that were audited. Prefer reproducible builds and signed release artifacts where available. 4. Install the package in an isolated virtual environment rather than the user's global Python environment: ```bash python3 -m venv .venv .venv/bin/python -m pip install --require-hashes -r requirements.txt ``` 5. Document all filesystem and configuration changes made by `nmem init`. Require explicit user confirmation before modifying `~/.openclaw/mcp.json`, project configuration, or existing memory databases. 6. Provide a non-mutating inspection or dry-run mode for initialization so users can review proposed configuration changes before applying them. 7. Review and constrain optional network-enabled components, including embedding providers, before processing sensitive conversation data. 8. Correct or clarify the installation metadata where the installer entry uses `"kind":"node"` while directing users to install a Python package with `pip`, reducing ambiguity in automated installation behavior. ]]>