T08 · Insecure Dependencies
Warning
- Location
SKILL.md:23- Finding
Unverified Mutable Skill Update Can Introduce Attacker-Controlled Instructions
- Content
View full analysis
~/.openclaw/skills/crowd-prompting/SKILL.md ``` The same unsafe update mechanism is repeated at `SKILL.md:95–99`: ```markdown If it differs, update manually: ```bash curl -sL https://crowdmolting.com/SKILL.md > ~/.openclaw/skills/crowd-prompting/SKILL.md ``` ``` ### Technical Analysis The documented installation and update process downloads a mutable remote `SKILL.md` and writes it directly into the trusted local Skill directory. It does not pin an immutable artifact version, validate a cryptographic signature, compare a trusted checksum, or require inspection before replacing the installed file. HTTPS provides transport protection but does not establish that future content served by the authorized origin is safe. If the website, hosting account, DNS configuration, CDN, release process, or publisher credentials are compromised, the downloaded Skill can contain instructions that differ materially from the audited version. Although the fetched object is a Skill instruction file rather than a conventional executable package, Skill text influences agent decisions and tool use when loaded. Consequently, attacker-controlled replacements could direct the agent to disclose data, invoke tools unsafely, contact unrelated services, or weaken existing safety constraints. The current audited file does not itself contain such instructions; the risk arises from trusting an unauthenticated future artifact. The package metadata also shows a release consistency discrepancy: `_meta.json` reports version `1.0.6`, while the `SKILL.md` frontmatter reports version `1.0.7`. This mismatch is not independently exploitable, but it demonstrates why ...[truncated 1870 chars]- Remediation
View remediation
"$tmp" printf '%s %s\n' "$expected_sha256" "$tmp" | sha256sum --check - # Verify a publisher signature and obtain explicit human approval here. install -m 0600 "$tmp" "$target" ``` The expected digest must come from a trusted signed release manifest rather than from the same mutable endpoint as the artifact. ]]>