T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:143
- Finding
- Unpinned Remote Repository Used as an Installation Source## Vulnerability Details **File Location**: `SKILL.md:143-157` and `README.md:45-51` **Vulnerability Type**: Supply-chain exposure through an unpinned remote installation source **Risk Level**: Medium ### Vulnerable Code `SKILL.md:143-157`: ```markdown ## Install from GitHub You can install this skill directly from GitHub when ClawHub is unavailable (for example, rate-limit errors). Repository: - `https://github.com/domilin/marsbit-news-skill` Example local install: ```bash git clone https://github.com/domilin/marsbit-news-skill /tmp/marsbit-news-skill mkdir -p ~/.openclaw/skills/opennews cp -R /tmp/marsbit-news-skill/openclaw-skill/opennews/* ~/.openclaw/skills/opennews/ openclaw skills list ``` ``` `README.md:45-51`: ```markdown ### 2) Install from GitHub ```bash git clone https://github.com/domilin/marsbit-news-skill /tmp/marsbit-news-skill mkdir -p ~/.openclaw/skills/opennews cp -R /tmp/marsbit-news-skill/openclaw-skill/opennews/* ~/.openclaw/skills/opennews/ openclaw skills list ``` ``` ### Technical Analysis The documented fallback installation process clones the mutable default branch of a remote GitHub repository and immediately copies its contents into the user's OpenClaw skill directory. It does not pin a reviewed commit hash or immutable release, and it performs no checksum, signature, or file-content verification. Consequently, the effective installed skill can differ from the artifact reviewed during this audit. If the repository, maintainer account, or default branch is compromised, an attacker could modify skill instructions or introduce additional files before a user performs the installation. This is an insecure supply-chain practice rather than evidence that the currently audited repository contains malicious code. ### Attack Path 1. An attacker compromises the upstream GitHub repository, a maintainer account, or another mechanism capable of modifying its defa ...[truncated 1168 chars]
- Remediation
- ## Remediation Suggestions 1. Pin installation to a reviewed full commit hash or an immutable signed release rather than the repository's default branch. 2. Publish a SHA-256 digest for each released skill artifact and require verification before installation. 3. Sign releases or commits using a verifiable maintainer key and document signature verification steps. 4. Review the checked-out file list before copying it into the OpenClaw skill directory. 5. Avoid recursively copying arbitrary repository content. Install only an explicit allowlist of expected files. 6. Use a freshly created temporary directory and remove it after installation to avoid stale or attacker-prepositioned content. 7. Prefer a trusted package registry or release artifact with integrity metadata. A hardened installation flow should resemble: ```bash git clone https://github.com/domilin/marsbit-news-skill /tmp/marsbit-news-skill cd /tmp/marsbit-news-skill git checkout --detach FULL_REVIEWED_COMMIT_HASH test "$(git rev-parse HEAD)" = "FULL_REVIEWED_COMMIT_HASH" sha256sum --check published-checksums.txt mkdir -p ~/.openclaw/skills/opennews cp openclaw-skill/opennews/SKILL.md ~/.openclaw/skills/opennews/ cp openclaw-skill/opennews/package.json ~/.openclaw/skills/opennews/ ``` The checksum manifest itself should be obtained through a signed, independently verifiable release channel.