T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:65
- Finding
- Mutable Remote Installer Is Piped Directly into Bash<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 65-67 **Vulnerability Type**: Remote code retrieval and execution without integrity verification **Risk Level**: Critical ### Vulnerable Code ```bash # Use the official installation script curl -fsSL https://openclaw.ai/install.sh | bash ``` ### Technical Analysis The Skill instructs the user or executing Agent to download a mutable shell script and immediately pass its contents to Bash. The payload is not pinned to a version, saved for inspection, checked against a cryptographic digest, or authenticated through a publisher signature. TLS protects the network connection under ordinary conditions, but it does not protect users if the domain, DNS configuration, web server, deployment pipeline, or publisher account is compromised. Because the response is executed as it arrives, the effective code can change after the Skill itself has been reviewed. This execution mechanism is not required for the declared functionality because the project already provides an alternative package-manager installation method. ### Attack Path 1. An attacker compromises the installer host, publishing pipeline, DNS, or another component capable of controlling the response from `https://openclaw.ai/install.sh`. 2. The attacker replaces the installer with a malicious shell payload. 3. A user or Agent follows the Skill instructions and runs the pipeline. 4. Bash executes the attacker-controlled response without an intermediate review or integrity check. 5. The payload gains all permissions available to the account running the command and can access that account's files, credentials, processes, and OpenClaw configuration. ### Impact Assessment Arbitrary command execution is possible with the invoking user's privileges. If the instruction is run from a privileged account, the impact extends to those elevated privileges. Potential consequences include theft of OpenClaw and API credentials, modification of user fi ...[truncated 111 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | bash` instruction. 2. Distribute a versioned installer or package with an immutable release identifier. 3. Download the artifact to a local file before execution. 4. Verify a publisher signature and a separately distributed, pinned SHA-256 digest. 5. Display the verified script and request explicit user approval before running it. 6. Execute installation under an unprivileged account and avoid `sudo` unless a specific operation demonstrably requires it. 7. Prefer an exact, pinned package-manager version with lockfile and provenance verification. ]]>