T03 · Remote Payload Retrieval and Execution
- Location
scripts/install_or_update.sh:4- Finding
Mutable Remote Repository Is Installed and Executed Without Integrity Verification
- Content
View full analysis
Vulnerability Details
File Location:
scripts/install_or_update.sh:4-19,scripts/run_finance_example.sh:19-24
Vulnerability Type: Remote payload retrieval and execution
Risk Level: HighThe installation helper clones or fetches content from a mutable remote Git repository without pinning an audited commit or verifying a cryptographic signature or checksum:
bash REPO_DIR="${1:-$HOME/.openclaw/workspace/AutoResearchClaw}" REPO_URL="https://github.com/ChipmunkRPA/FinResearchClaw.git" mkdir -p "$(dirname "$REPO_DIR")" if [ -d "$REPO_DIR/.git" ]; then echo "Updating existing repo metadata at $REPO_DIR" git -C "$REPO_DIR" remote get-url origin >/dev/null 2>&1 || true git -C "$REPO_DIR" fetch --all --prune CURRENT_BRANCH="$(git -C "$REPO_DIR" branch --show-current || true)" echo "Current branch: ${CURRENT_BRANCH:-unknown}" echo "Fetched latest refs. Review/merge manually if you do not want automatic fast-forwards." else echo "Cloning FinResearchClaw into $REPO_DIR" git clone "$REPO_URL" "$REPO_DIR" fiThe example runner subsequently installs the checked-out project in editable mode and executes its CLI with automatic approval enabled:
bash cd "$REPO_DIR" python3 -m venv .venv >/dev/null 2>&1 || true source .venv/bin/activate python -m pip install -e . researchclaw run --config "$CONFIG_PATH" --auto-approveTechnical Analysis
The effective code payload is controlled by the current contents of an external repository rather than an immutable, previously audited revision. A fresh clone checks out the remote repository's current default branch. Although the update path only fetches references and does not explicitly merge them, the fresh-install path remains mutable, and users may later update or merge fetched content.
Running
python -m pip install -e .treats the retrieved repository as executable package source. Depending on its Python packaging con ...[truncated 2031 chars]- Remediation
View remediation
Remediation Suggestions
- Pin installation to a specific, reviewed commit hash or immutable signed release rather than the current default branch.
- Verify the downloaded revision before installation using a trusted commit or tag signature and an independently maintained allowlist of expected commit hashes.
- Refuse execution when the checked-out commit differs from the approved revision, and display the exact remote URL and commit identifier before proceeding.
- Use a locked dependency set with cryptographic hashes, such as a generated lock file and hash-enforced installation, to reduce transitive supply-chain risk.
- Avoid editable installation for routine execution. Build a reproducible artifact from the verified source and install that artifact into an isolated environment.
- Remove
--auto-approvefrom the default command. Require explicit, informed user opt-in after showing the selected configuration and planned operations. - Execute the retrieved workflow in a sandbox or container with minimal filesystem access, restricted network access, no unnecessary credentials, and no elevated privileges.
- For existing clones, validate that the configured
originexactly matches the expected repository before fetching. Do not rely only on the presence of a.gitdirectory.