T08 · Insecure Dependencies
Error
- Location
- SKILL.md:77
- Finding
- Unpinned Third-Party Package Is Retrieved and Executed at Runtime## Vulnerability Details **File Location**: `SKILL.md:77-91`; `references/setup-guide.md:17-23`; `references/setup-guide.md:45-55` **Vulnerability Type**: Unpinned runtime dependency and mutable supply-chain execution **Risk Level**: High ### Vulnerable Code From `SKILL.md:77-91`: ```bash uv tool install proxy-aiops proxy-aiops init # wizard: pick platform (traefik/caddy/haproxy) + optional encrypted secret proxy-aiops doctor ``` ```bash openclaw plugins install clawhub:@zw008/proxy-aiops openclaw skills info proxy-aiops # expect: Visible to model: yes ``` ```text Needs `uvx` on `PATH`: the MCP server is fetched with uv, pinned to this release. ``` From `references/setup-guide.md:45-55`: ```json { "mcpServers": { "proxy-aiops": { "command": "uvx", "args": ["--from", "proxy-aiops", "proxy-aiops-mcp"], "env": { "PROXY_AIOPS_MASTER_PASSWORD": "your-master-password" } } } } ``` ### Technical Analysis The installation commands and MCP configuration identify the package only as `proxy-aiops`; no exact version, package hash, lockfile, or immutable artifact reference is provided. The OpenClaw plugin command is similarly not pinned to an immutable release in the reviewed files. The statement that the MCP server is “pinned to this release” is not supported by the shown `uvx` command. The argument: ```text --from proxy-aiops ``` allows package resolution to select a registry version according to the package manager's current resolution behavior. Consequently, the effective executable can change after this Skill has been reviewed. This artifact contains documentation only and does not include the installed package's implementation. Claims concerning credential redaction, network destinations, TLS verification, auditing, undo behavior, and write safeguards therefore cannot be independently verified from the reviewed project. Because the fetch ...[truncated 1976 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the package to an exact reviewed version: ```json { "command": "uvx", "args": [ "--from", "proxy-aiops==X.Y.Z", "proxy-aiops-mcp" ] } ``` 2. Require cryptographic hashes for all resolved distributions and maintain a committed lockfile containing exact transitive dependency versions. 3. Pin the OpenClaw plugin to an immutable version or content digest instead of relying on a mutable package reference. 4. Include the executable package source in the review artifact, or link the Skill to a reproducible build whose source revision and package digest can be verified. 5. Verify package signatures or provenance attestations before installation. 6. Prevent automatic upgrades during MCP startup. Resolve and install an approved artifact separately, then execute the already-installed binary. 7. Run the MCP server under a dedicated, minimally privileged operating-system account with access only to the necessary configuration and proxy endpoints. 8. Restrict outbound network access to explicitly configured proxy API addresses and required certificate-probe destinations. 9. Add CI checks that reject unversioned dependency references and verify that documentation claims about pinning match the actual commands.