T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:124
- Finding
- Unpinned Remote Python Script Retrieval and Local Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 124–133 **Vulnerability Type**: Remote mutable payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```markdown ## Subexec Pattern Pipe incoming messages to a shell command (like claw.events subexec): ```bash python botworld_subexec.py -c "public.*" -c "system.*" -e "python handler.py" ``` Each message is passed as a JSON line to the handler's stdin. The handler has 30 seconds to process each message. Get `botworld_subexec.py` from: https://botworld.me or the BotWorld GitHub. ``` ### Technical Analysis The Skill instructs users to obtain `botworld_subexec.py` from an external website or an unspecified GitHub repository and then execute the downloaded Python script locally. It does not provide an immutable download URL, pinned repository commit, version, cryptographic checksum, digital signature, or bundled auditable copy of the script. Consequently, the code executed by users can differ from the code available when the Skill was audited. Compromise of the website, repository, publishing account, DNS path, or distribution infrastructure could replace the referenced script with an arbitrary payload. The script is also intended to subscribe to wildcard channels such as `public.*`. According to the documented channel permissions, any authenticated agent can publish to public channels. Messages originating from this externally controlled trust boundary are forwarded as JSON lines to a local handler. Although the documented example passes messages through standard input rather than directly interpolating them into a command, the unavailable remote script cannot be audited for parsing, command construction, or validation weaknesses. ### Attack Path 1. An attacker compromises or gains control over the website, repository, publishing account, or other infrastructure used to distribute `botworld_subexec.py`. 2. The attacker replaces the scr ...[truncated 1713 chars]
- Remediation
- ## Remediation Suggestions 1. Bundle the reviewed `botworld_subexec.py` implementation directly in the Skill package so its contents are included in security review. 2. If remote distribution is necessary, provide an exact HTTPS URL tied to an immutable repository commit rather than a website homepage or mutable branch. 3. Publish a SHA-256 or stronger cryptographic digest and require verification before execution. 4. Digitally sign releases and document a signature-verification procedure using a separately distributed trusted public key. 5. Specify the expected script version, source repository, commit identifier, file path, and maintainers. 6. Run the subscriber with a dedicated, unprivileged account or inside a restricted container or sandbox. 7. Restrict filesystem access, environment variables, credentials, and outbound network access to the minimum required. 8. Avoid wildcard public-channel subscriptions by default. Require explicit channel allowlists when practical. 9. Treat all received message fields as untrusted data. Parse them strictly as JSON and never interpolate them into shell commands. 10. Ensure handlers receive input only through a defined data interface, apply schema and size validation, and execute with time and resource limits. 11. Document that public channel history and messages are not suitable for secrets or private task data.