T03 · Remote Payload Retrieval and Execution
- Location
SKILL.md:33- Finding
Mutable Remote Repository Is Retrieved and Executed
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 33-50
Vulnerability Type: Remote payload retrieval and execution
Risk Level: HighVulnerable Code
bash git clone https://github.com/darrenjrobinson/voice-esp32-openclaw.git cd voice-esp32-openclaw cp .env.example .envThe subsequently retrieved project is built and started with:
bash docker compose --profile bridge up -d --build docker compose logs -f voice-bridge # expect: "Connected to <device> (…)" and "device announcement format: flac @ 48000 Hz"Technical Analysis
The Skill instructs users to clone the mutable default branch of an external GitHub repository and then build and execute its Docker Compose configuration. It does not pin the repository to an audited commit hash or immutable signed release.
Consequently, the code ultimately executed can differ from the code present when the Skill was reviewed. The audited package contains neither the referenced Dockerfile and Compose file nor the bridge implementation and dependency manifests, so their effective behavior and privileges cannot be verified from this artifact.
This exceeds a safely reviewable execution model because control over the upstream default branch effectively provides control over the payload run by users. Although the remote repository is necessary to obtain the declared bridge implementation, retrieving and executing a mutable revision is not the minimum privilege or trust required to provide that functionality.
Attack Path
- An attacker compromises the upstream repository, a maintainer account, or another mechanism capable of changing its default branch.
- The attacker modifies the Dockerfile, Compose configuration, bridge source, or dependency definitions.
- A user follows the Skill instructions and clones the current, attacker-controlled default branch.
- The user populates
.envwith provider API keys, the OpenClaw bearer ...[truncated 1278 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin the upstream source to a reviewed full commit SHA rather than cloning and executing the mutable default branch.
- Prefer bundling the reviewed bridge source, Dockerfile, Compose file, dependency manifests, and lockfiles directly with the Skill.
- Publish immutable release artifacts with cryptographic checksums and signed provenance, and require verification before building or running them.
- Pin container base images by digest and lock all language dependencies to exact versions with integrity hashes.
- Audit the Compose configuration and enforce least privilege: do not mount the Docker socket, avoid privileged containers and host networking, use read-only filesystems where possible, drop Linux capabilities, run as a non-root user, and expose only required ports.
- Pass only provider credentials required by the selected STT and TTS configuration. Use Docker secrets or another dedicated secret store instead of broadly exposing credentials through the container environment where practical.
- Document the external transmission of voice recordings and transcripts, restrict outbound traffic to the selected providers and OpenClaw endpoint, and use encrypted transport for sensitive communications whenever supported.