T03 · Remote Payload Retrieval and Execution
Error
- Location
- references/marketplace.md:27
- Finding
- Mutable Marketplace Strategies Are Downloaded and Executed as Local Python<![CDATA[ ## Vulnerability Details **File Location**: `references/marketplace.md:27-40` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```text Fetch strategy code (requires purchase): ``` GET /openclaw/marketplace/strategies/{id}/code ``` Response: `{"code": "..."}` — save to `.py` and run with `python3`. **Flow when user wants to run a purchased strategy:** 1. `GET /openclaw/marketplace/my/purchases` — show the list 2. User picks one → `GET /openclaw/marketplace/strategies/{id}/code` 3. Save to `/tmp/<filename>.py` 4. **Check for multi-strategy bundle** — scan for `# ===== STRATEGY \d+:` markers: - If found: split into separate files and deploy each (see "Multi-strategy bundle" below) - If not found: `python3 filename.py` ``` Related instructions at `references/marketplace.md:92-100` state that downloaded bundles are moved into a strategy directory and executed, while private strategies are not reviewed: ```text **Deploying** — when downloaded code contains `# ===== STRATEGY N:` markers: 1. Split at each marker into N separate strings 2. Save each to `/tmp/<name_slug>.py` (slug from the name after the colon) 3. Security scan each file separately; skip any that exit 2 (critical) 4. Move approved files to `strategies/<name_slug>.py` and run each with `python3` ## Private strategies Upload a private strategy (no review, immediately accessible): ``` ### Technical Analysis The Skill establishes an explicit code-execution channel from the mutable Blave marketplace API to the local Python interpreter. Marketplace content is not part of the audited Skill artifact and can change after this Skill has been reviewed. The ordinary single-strategy path directs the agent to execute the downloaded file without any security review. The bundle path mentions a security scan, but does not define the scanner, its trust boundary, its coverage, or a sandbox. Treating one scanner exit status as sufficient a ...[truncated 2354 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all instructions that directly execute marketplace responses with `python3`. 2. Require each strategy release to be signed by a verified publisher and identified by an immutable cryptographic digest. 3. Verify the signature and digest locally before storing or evaluating the strategy. 4. Display the publisher identity, source version, digest, requested capabilities, and complete source diff to the user before execution. 5. Require a separate, explicit user confirmation for executing each exact strategy digest. Approval of one digest must not authorize later versions. 6. Apply a defined security review to every strategy, including ordinary files, bundles, updates, and private shares. 7. Run approved strategies in an isolated container or sandbox with: - No inherited environment variables. - No access to `.env`, SSH material, home directories, or agent configuration. - A read-only filesystem except for a dedicated temporary working directory. - No host process or shell access. - No outbound network access by default. - Explicit destination allowlists when network access is necessary. - CPU, memory, process, and execution-time limits. 8. Provide exchange access through a constrained broker interface rather than exposing raw API credentials to strategy processes. 9. Use read-only or paper-trading credentials by default and require separate authorization for live trading. 10. Treat private and shared strategies as untrusted even when the sender appears known. ]]>