T08 · Insecure Dependencies
Warning
- Location
- README.md:56
- Finding
- Unpinned Third-Party Skill Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `README.md:56-64` **Vulnerability Type**: Supply-chain exposure through unpinned executable dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # Install all dependent Skills openclaw skill install agent-reach openclaw skill install summarize openclaw skill install xiaohongshu-mcp openclaw skill install card-renderer openclaw skill install wechat-article-pro ``` ### Technical Analysis The installation instructions identify five executable third-party Skills only by mutable package name. They do not specify reviewed versions, immutable digests, publisher identities, cryptographic signatures, or an approved registry. Consequently, the code installed when these commands are executed can change after this project has been audited. A compromised upstream release, registry account, or package-name resolution process could cause users to install malicious code without any modification to this repository. The affected dependencies perform sensitive operations such as gathering external content, rendering files, and publishing to authenticated social-media accounts. Their implementations are not included in this repository and therefore could not be verified during this audit. ### Attack Path 1. An attacker compromises a dependency publisher or the registry entry for one of the named Skills. 2. The attacker publishes a malicious release under the same mutable dependency name. 3. A user follows the documented installation commands. 4. OpenClaw resolves and installs the attacker's current package version. 5. The malicious Skill executes when the workflow invokes it. 6. Depending on the runtime permissions granted to that Skill, it may access configured platform credentials, alter generated content, publish unauthorized material, or perform other actions available to the Agent. ### Impact Assessment Successful exploitation would execute attacker-controlled dependency logic with the permissions gran ...[truncated 599 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to an explicitly reviewed version or immutable content digest. 2. Declare the expected registry, canonical package identity, and verified publisher for each Skill. 3. Require cryptographic signature or checksum verification before installation. 4. Maintain a lock file or equivalent dependency manifest that prevents automatic resolution to newer releases. 5. Review dependency source code and release changes before updating pinned versions. 6. Grant each dependency only the minimum tools, filesystem paths, network destinations, and credentials required for its role. 7. Isolate publishing credentials from discovery, summarization, and rendering dependencies. 8. Add automated dependency-integrity and provenance checks to the installation process. ]]>