T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:148
- Finding
- Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 148-152 **Vulnerability Type**: Unpinned third-party dependencies and mutable package installer **Risk Level**: Medium ### Vulnerable Code ```bash npx clawhub@latest install agent-reach npx clawhub@latest install brave-search npx clawhub@latest install summarize npx clawhub@latest install paddleocr-doc-parsing npx clawhub@latest install n8n-workflow-automation ``` ### Technical Analysis The documented installation process invokes the mutable `latest` release of `clawhub` and installs five remotely sourced Skills without fixed versions or integrity verification. Consequently, the commands may retrieve code that differs from the code available when this project was audited. Because `npx` can download and execute the selected package, compromise of the package registry, publisher account, installer package, or any referenced Skill release could turn this installation procedure into a supply-chain execution channel. No malicious payload is present in the audited project itself; the risk arises from trusting mutable, unverified external dependencies. ### Attack Path 1. An attacker compromises a relevant package publisher, registry entry, distribution account, or future dependency release. 2. The attacker publishes malicious code under the release selected by `@latest` or within one of the unpinned Skills. 3. A user follows the installation commands in `SKILL.md`. 4. `npx` retrieves and executes the mutable `clawhub` package. 5. The installer retrieves and activates the compromised Skill dependency. 6. Malicious code executes with the permissions of the user or automation environment running the installation. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the installing user's privileges. Depending on that environment, an attacker could access local files and credentials available to the user, alter the OpenClaw workspace, tamper with generated reports, ac ...[truncated 240 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `clawhub` to a specific reviewed version rather than using `@latest`. 2. Pin every installed Skill to an explicit, reviewed version or immutable revision. 3. Use lockfiles and cryptographic integrity hashes where supported. 4. Restrict installation to an approved registry and validate package provenance or signatures. 5. Audit the complete transitive dependency set before deployment. 6. Perform installation in a sandboxed, least-privilege environment without production secrets. 7. Introduce an update-review process so dependency changes are tested and approved before rollout.