T08 · Insecure Dependencies
- Location
README.md:42- Finding
Unverified Mutable Repository Used for Manual Skill Installation
- Content
View full analysis
Vulnerability Details
File Location:
README.md, line 42
Vulnerability Type: Unverified third-party supply-chain source
Risk Level: MediumVulnerable Code:
bash git clone https://github.com/yourusername/zeelin-academic-paper.git ~/.openclaw/workspace/skills/zeelin-academic-paperTechnical Analysis
The documented manual installation command clones a repository directly into the active OpenClaw Skill directory. The repository URL contains the placeholder owner
yourusername, does not correspond to a verified canonical source in the reviewed package, and is not pinned to a release tag or immutable commit. The command also performs no signature, checksum, or provenance verification.A Git repository's default branch is mutable. Consequently, the content installed by this command can differ from the content that was audited. If the placeholder repository exists or is later registered by an attacker, or if the referenced repository is compromised, a user following the instructions could install attacker-controlled Skill instructions or executable files.
The reviewed package itself contains no malicious executable code, remote payload retrieval behavior, credential access, persistence mechanism, or data-exfiltration logic. The risk arises specifically from the unsafe manual installation instruction.
Attack Path
- An attacker creates, acquires, or compromises the repository identified by the documented URL.
- The attacker publishes a modified Skill package containing hostile Agent instructions, scripts, or configuration.
- A user follows the README and executes the provided
git clonecommand. - Git retrieves the mutable repository without validating its identity, release version, signature, or content hash.
- The attacker-controlled files are written directly to
~/.openclaw/workspace/skills/zeelin-academic-paper. - OpenClaw discovers or loads the installed Skill.
- Malicious ins ...[truncated 901 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the placeholder repository URL with the verified canonical repository controlled by the documented project owner.
- Pin installation to an immutable, reviewed commit hash rather than cloning a mutable default branch.
- Publish signed releases and verify the release signature before installation.
- Publish a SHA-256 checksum for each release archive and require checksum verification in the installation procedure.
- Download and validate the package in a staging directory before moving it into the active OpenClaw Skill directory.
- Configure the runtime to require explicit approval for newly declared capabilities and to deny script execution unless necessary.
- Keep the README version, Skill manifest version, repository release, and integrity metadata synchronized.
- Remove the manual clone instruction until a valid and verifiable canonical repository is available.