T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:67
- Finding
- Unpinned Remote Repository Retrieval and Local Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 67-73 **Vulnerability Type**: Mutable remote payload retrieval and execution **Risk Level**: High ```bash # Clone the fork git clone https://github.com/globalcaos/tinkerclaw.git openclaw cd openclaw # Build (includes Tinker UI) pnpm install pnpm build ``` ### Technical Analysis The installation instructions clone the default branch of a third-party GitHub repository without pinning it to a reviewed commit hash or cryptographically verified release. The subsequent `pnpm install` and `pnpm build` commands process and execute content controlled by that remote repository. In particular, package installation can execute dependency lifecycle scripts, while the build command executes repository-defined package scripts and build tooling. Because the referenced source code, package manifests, dependency lockfile, and scripts are not included in the audited artifact, the claims that the software is read-only and does not transmit data cannot be verified from this package. The effective payload can change after the Skill has been reviewed. Compromise of the repository owner, default branch, release process, or dependency graph could therefore convert these documented installation steps into arbitrary local code execution. ### Attack Path 1. An attacker compromises the third-party repository, its maintainer account, the default branch, or a dependency used by the project. 2. The attacker introduces malicious package lifecycle logic, build scripts, source code, or dependency changes. 3. A user follows the instructions and clones the current default branch with `git clone`. 4. The user runs `pnpm install`, which may execute attacker-controlled dependency or project lifecycle scripts. 5. The user runs `pnpm build`, which executes repository-defined build logic. 6. The malicious code runs with the privileges and environment access of the installing user. ### Impa ...[truncated 726 chars]
- Remediation
- ## Remediation Suggestions - Pin the repository checkout to a specific, independently reviewed full commit hash rather than the mutable default branch. - Prefer a signed release and document how users must verify its signature and expected checksum before installation. - Include the actual implementation, package manifest, and dependency lockfile in the auditable Skill package. - Require deterministic installation with a reviewed lockfile, such as `pnpm install --frozen-lockfile`. - Disable lifecycle scripts during dependency installation with `--ignore-scripts` where feasible. Review and invoke each genuinely required script separately. - Audit all direct and transitive dependencies, including provenance, integrity hashes, lifecycle scripts, and maintainer history. - Build and run the application with least privilege in an isolated environment that does not expose unrelated credentials or sensitive files. - Document the exact network endpoints and local data accessed by the application so its read-only and no-exfiltration claims can be independently validated.