T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:97- Finding
Unauthenticated Remote Installer and Release Payload Execution
- Content
View full analysis
&2 exit 1 fi if ! unzip -tq "${STAGE}/${ZIP_NAME}" >/dev/null 2>&1; then echo "error: ${ZIP_NAME} is not a valid zip (site may not have published this version yet)" >&2 echo " URL: ${ZIP_URL}" >&2 exit 1 fi echo "-> Extract ..." unzip -qo "${STAGE}/${ZIP_NAME}" -d "$STAGE/extract" if [[ ! -f "${STAGE}/extract/SKILL.md" ]]; then echo "error: invalid zip layout (SKILL.md must be at zip root)" >&2 exit 1 fi EXTRACT_ROOT="${STAGE}/extract" MANIFEST_JSON="${EXTRACT_ROOT}/references/openclaw-release-manifest.json" if [[ ! -f "$MANIFEST_JSON" ]] && [[ -f "${EXTRACT_ROOT}/scripts/write-openclaw-release-manifest-json.mjs" ]]; then echo "-> Generate release manifest (legacy zip) ..." (cd "$EXTRACT_ROOT" && node scripts/write-openclaw-release-manifest-json.mjs) || true fi ``` From `scripts/install.sh:146-159`: ```bash export CLAWBBA_SKILL_EXTRACT_ROOT="$EXTRACT_ROOT" node "${EXTRACT_ROOT}/scripts/openclaw-align-version.mjs" "$EXTRACT_ROOT" source "${STAGE}/extract/scripts/openclaw-detect-version.sh" if ! openclaw_detect_version_from_skill "${STAGE}/extract" 1; then exit 1 fi ``` ### Technical Analysis The docume ...[truncated 2636 chars]- Remediation
View remediation