T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:6
- Finding
- Mutable Remote Installation Script Is Executed Directly by Bash<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:6`, `SKILL.md:29`, and `README.md:14` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code `SKILL.md:6`: ```yaml metadata: {"openclaw":{"emoji":"🔑","requires":{"bins":["curl"],"config":["skills.entries.clawapi"]},"install":[{"kind":"script","command":"curl -fsSL https://raw.githubusercontent.com/Gogo6969/clawapi/main/install.sh | bash"}]}} ``` `SKILL.md:28-30`: ```bash curl -fsSL https://raw.githubusercontent.com/Gogo6969/clawapi/main/install.sh | bash ``` `README.md:13-15`: ```bash curl -fsSL https://raw.githubusercontent.com/Gogo6969/clawapi/main/install.sh | bash ``` ### Technical Analysis The installation command retrieves `install.sh` from the mutable `main` branch of a personal GitHub repository and pipes the response directly into Bash. This creates a remote code-execution channel whose effective payload may change after the Skill package has been reviewed. The audited project contains only `README.md` and `SKILL.md`. It does not include the installer, application source, a pinned Git commit, a release artifact checksum, or a trusted manifest against which the remote content can be independently verified. Consequently, the documentation claims that the installer downloads a signed archive and validates its SHA-256 checksum cannot be confirmed from the audited files. Even if the current remote script is benign, the command does not bind installation to that version. Compromise of the GitHub account or repository, malicious modification of the `main` branch, or other control over the retrieved response could replace the installer with arbitrary shell commands. The `-f`, `-s`, and `-S` options affect transfer behavior but do not authenticate the content beyond HTTPS transport and do not provide payload immutability. This behavior exceeds the minimum privileges required for the declared Skill functionality. Describing or launchi ...[truncated 2346 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the automatic `curl | bash` installer from the Skill metadata and documentation. 2. Prefer a manually downloaded, versioned GitHub Release that users can inspect and verify before installation. 3. Pin every download to an immutable release version and commit rather than a mutable branch such as `main`. 4. Publish a fixed SHA-256 digest in the audited Skill package or through another trusted, independently controlled channel. Do not retrieve both the artifact and its expected checksum from the same mutable source without additional signature verification. 5. Download the installer or archive to a local file first instead of piping it directly into a shell. Verify integrity and authenticity before any execution. 6. Verify the macOS application signature and notarization status locally, for example with appropriate `codesign` and `spctl` checks, before moving it into `/Applications`. 7. Include the installer source in the reviewed project so its network requests, filesystem changes, permission requirements, and checksum verification can be audited. 8. If automation is essential, use a minimal installer pinned to a reviewed immutable commit and require explicit user confirmation before execution. 9. Document the exact files and directories the installer modifies and ensure it runs without elevated privileges unless a narrowly scoped privileged operation is demonstrably necessary. 10. Provide rollback instructions and ensure installation does not create launch agents, scheduled jobs, login items, or other persistence without explicit disclosure and consent. ]]>