github/openclaw
1
1
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-02-19 18:39:20 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): add --ignore-scripts to skills install commands (#14659)

Browse Source 
Skills install runs package manager install commands (npm, pnpm, yarn,
bun) without --ignore-scripts, allowing malicious npm packages to
execute arbitrary code via postinstall/preinstall lifecycle scripts
during global installation.

This is inconsistent with the security fix in commit 92702af7a which
added --ignore-scripts to both plugin installs (src/plugins/install.ts)
and hook installs (src/hooks/install.ts). Skills install was overlooked
in that change.

Global install (-g) is particularly dangerous as scripts execute with
the user's full permissions and can modify globally-accessible binaries.
This commit is contained in:
Yi Liu
2026-02-13 01:56:35 +08:00
committed by GitHub
parent 4c86010b06
commit d3aee84499
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/agents/skills-install.ts
View File

@@ -147,13 +147,13 @@ function findInstallSpec(entry: SkillEntry, installId: string): SkillInstallSpec
function buildNodeInstallCommand(packageName: string, prefs: SkillsInstallPreferences): string[] {
switch (prefs.nodeManager) {
case "pnpm":
return ["pnpm", "add", "-g", packageName];
return ["pnpm", "add", "-g", "--ignore-scripts", packageName];
case "yarn":
return ["yarn", "global", "add", packageName];
return ["yarn", "global", "add", "--ignore-scripts", packageName];
case "bun":
return ["bun", "add", "-g", packageName];
return ["bun", "add", "-g", "--ignore-scripts", packageName];
default:
return ["npm", "install", "-g", packageName];
return ["npm", "install", "-g", "--ignore-scripts", packageName];
}
}