T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:7
- Finding
- Unverified Remote Executable Download and Immediate Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 7-16 and 24-29 **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution, T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```yaml metadata: openclaw: emoji: "🔌" os: ["win32"] install: - id: hid-dock-win-x64 kind: download os: ["win32"] url: "https://github.com/facaiHero/hid-dock/releases/download/v1.0.0/hid-dock-win-x64.zip" archive: zip extract: true targetDir: "." label: "Download hid-dock CLI (Windows x64, self-contained)" ``` ```powershell $exe = "$env:USERPROFILE\.openclaw\tools\hid-dock\hid-dock.exe"; if (-not (Test-Path $exe)) { New-Item -ItemType Directory -Force -SplitPath $exe | Out-Null; $z = "$env:TEMP\hid-dock-win-x64.zip"; Invoke-WebRequest "https://github.com/facaiHero/hid-dock/releases/download/v1.0.0/hid-dock-win-x64.zip" -OutFile $z; Expand-Archive $z -DestinationPath (Split-Path $exe) -Force; Remove-Item $z; "installed" } else { "already installed" }; & $exe info ``` ### Technical Analysis The skill obtains a precompiled Windows executable from a release under a personal GitHub account, extracts it into `%USERPROFILE%\.openclaw\tools\hid-dock`, and immediately executes it. The downloaded archive is not authenticated through a pinned cryptographic digest, Authenticode publisher validation, or another independent integrity mechanism. A versioned release URL does not by itself establish artifact integrity or publisher authenticity. If the hosting account, release asset, or distribution path is compromised or replaced, the effective executable payload can differ from the artifact originally reviewed. The source code for the CLI is not included in the audited project, so its internal behavior cannot be verified from the package. The metadata installer creates the same external dependency, while the first-run PowerShell command makes the execution path explicit. Im ...[truncated 2122 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Pin the artifact cryptographically** - Publish the expected SHA-256 digest in the reviewed skill package. - Compute the downloaded archive's digest before extraction. - Abort installation on any mismatch. 2. **Validate publisher identity** - Authenticode-sign `hid-dock.exe` with a trusted code-signing certificate. - Verify that the signature is valid and that the signer exactly matches the documented publisher. - Fail closed if the executable is unsigned, the signature is invalid, or the signer differs. 3. **Use an auditable distribution model** - Include the CLI source code and reproducible build instructions. - Prefer an official, organization-controlled repository over a personal hosting account. - Document how the published binary corresponds to the reviewed source. 4. **Avoid immediate execution** - Separate download, verification, extraction, and execution into distinct steps. - Execute the binary only after every integrity and authenticity check succeeds. - Obtain user confirmation before first execution of a newly installed native binary. 5. **Harden archive handling** - Download to a uniquely created private temporary directory rather than a predictable shared filename. - Validate archive entries and reject absolute paths or traversal sequences before extraction. - Extract into a staging directory and move the verified executable into its final location atomically. 6. **Reduce execution privileges** - Run the utility as a standard user and never request elevation unless a documented HID operation strictly requires it. - Restrict filesystem and network access through sandboxing or process isolation where available. - Limit the CLI to the fixed VID/PID and required HID operations. A hardened installer should verify both the archive hash and executable signature before invoking `hid-dock.exe`, and it should terminate without execution if either check fails. ...[truncated 4 chars]