T08 · Insecure Dependencies
Warning
- Location
- README.md:180
- Finding
- Unpinned Third-Party Skill Dependencies## Vulnerability Details **File Location**: `README.md:180-184` **Additional Location**: `workflow.json:16-58` **Vulnerability Type**: Supply-chain risk from mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash clawhub install brave-search clawhub install agent-reach clawhub install nano-banana-pro clawhub install card-renderer clawhub install xiaohongshu-mcp ``` These commands install dependencies by name without specifying an exact version, immutable digest, checksum, or verified signature. The corresponding dependency declarations in `workflow.json:16-58` similarly reference mutable marketplace URLs without integrity metadata. ### Technical Analysis The workflow delegates security-sensitive operations to externally maintained Skills, including network searches, cross-platform content collection, image generation, and authenticated social-media publishing. Because dependency versions and artifact identities are not pinned, separate installations can resolve to different dependency implementations. The repository does not vendor or otherwise include the source of these dependencies, so their effective behavior cannot be established from this package alone. If a marketplace account, distribution channel, or dependency release is compromised, an altered dependency could be installed without any change to the audited repository. This is a supply-chain weakness rather than evidence that the currently referenced dependencies are malicious. ### Attack Path 1. An attacker compromises a referenced dependency, its publisher account, or its marketplace distribution entry. 2. The attacker publishes a modified release under the existing dependency name. 3. A user follows the documented unversioned `clawhub install` commands. 4. The installer resolves the dependency name to the attacker-controlled release. 5. The workflow invokes the compromised Skill during search, research, content gen ...[truncated 961 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every dependency to an exact, reviewed version or immutable artifact digest. 2. Add cryptographic checksums or signature verification and fail installation when verification is unavailable or unsuccessful. 3. Maintain a lock file recording resolved versions, artifact hashes, publisher identities, and source locations. 4. Review dependency source code and release changes before updating pinned versions. 5. Restrict each Skill to the minimum required network, filesystem, credential, and account permissions. 6. Isolate research, rendering, and publishing components so content-collection dependencies cannot access publishing credentials. 7. Preserve an explicit confirmation gate immediately before every external publication and enforce it in the publishing integration rather than relying only on workflow configuration. 8. Monitor dependency advisories and marketplace ownership changes, and establish a controlled update and rollback process.