T03 · Remote Payload Retrieval and Execution
Error
- Location
- check_skills.md:69
- Finding
- Remote installer is recommended through an unauthenticated curl-to-shell pipeline<![CDATA[ ## Vulnerability Details **File Location**: `check_skills.md:69` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```markdown **Fix (clawhub missing):** `npm install -g clawhub` or `curl -fsSL https://clawhub.io/install | bash` ``` ### Technical Analysis The recommended command downloads a mutable remote response and immediately executes it with the current user's privileges. There is no version pinning, checksum verification, signature validation, or opportunity to inspect the script before execution. Although the skill's safety gate requires user confirmation before state-changing fixes, confirmation does not make the retrieved payload trustworthy. The effective code can change after this skill package has been reviewed. Compromise of `clawhub.io`, its CDN, DNS resolution, TLS termination, or the installer publication process could result in arbitrary code execution. Installing the CLI may be relevant to skill-management functionality, but direct remote execution is not the minimum privilege or safest installation method. The documented `npm install -g clawhub` alternative also lacks version pinning and provenance verification, although it is less opaque than the pipeline. A similar unsafe recommendation appears at `check_hardware.md:73`: ```markdown **Fix (linux):** `curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo bash -` ``` That variant is more severe because the retrieved payload is passed to a privileged shell. ### Attack Path 1. A health check determines that `clawhub` or a supported Node.js version is missing. 2. The agent presents the documented curl-to-shell command as a remediation. 3. The user approves the proposed fix. 4. The shell retrieves the installer at execution time. 5. A compromised or malicious upstream response supplies arbitrary shell commands. 6. Those commands run as the invoking user, or as root in the `sudo bash` variant. ### Impact Assessment The ...[truncated 315 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove all `curl | bash` and `curl | sudo bash` recommendations. - Prefer a documented package-manager installation from a trusted repository. - Pin an exact package or installer version. - Download installers to a file before execution and verify a publisher signature or a pinned SHA-256 digest. - Display the source, version, digest, and exact local command before requesting confirmation. - Never execute downloaded content directly as root. Separate repository setup from package installation and minimize privileged operations. - For npm installation, use a pinned version such as `npm install -g clawhub@<reviewed-version>` and verify package provenance and integrity metadata. ]]>