T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:6- Finding
Mutable Remote Installation Script Is Executed Directly by Bash
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawAPI
Security checks for vulnerabilities and agentic risk
Overview
The skill's stated app is coherent, but its installer can run a mutable remote shell script before review, so users should review it carefully before installing.
Prefer the manual signed GitHub Release path over the curl-to-bash installer. Before using this skill, understand that it manages provider API keys, writes a sync copy into OpenClaw's auth-profiles.json, and modifies OpenClaw configuration; verify the app signature, release provenance, and any installer script before running it.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The use of '| bash' is a classic chaining pattern that executes network-retrieved content immediately, eliminating meaningful user review and turning any upstream compromise into direct code execution on the user's machine. In the context of a tool that manages API keys and modifies local auth configuration, successful exploitation could steal credentials, alter model/provider settings, or install persistence on the host.
- Content
Option 2 — Install script:
bash curl -fsSL https://raw.githubusercontent.com/Gogo6969/clawapi/main/install.sh | bashThe script downloads the signed
.zipfrom GitHub Releases, verifies the SHA-256 checksum, and installs the app. Review the script source before running.
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
Using '| bash' chains network retrieval directly into command execution, eliminating an inspection step and increasing the blast radius of any upstream compromise. In this skill's context, the app manages API keys and writes to OpenClaw configuration, so installer compromise could expose secrets, alter configs, or install persistence on the host.
- Content
Option 2: Install script
bash curl -fsSL https://raw.githubusercontent.com/Gogo6969/clawapi/main/install.sh | bashThe install script downloads the same signed
.zipfrom GitHub Releases, verifies the SHA-256 checksum, unzips it, and moves the app to/Applications. You can review the script source before running it.
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The README instructs users to fetch and execute a remote script in a single command, which creates a supply-chain and remote code execution risk if the GitHub account, repository, branch, or delivery path is ever compromised. Even though the text says the script verifies a checksum and suggests reviewing the source, the dangerous part is that arbitrary shell code is executed before the user can independently validate what it does.
- Content
Option 2 — Install script:
bash curl -fsSL https://raw.githubusercontent.com/Gogo6969/clawapi/main/install.sh | bashThe script downloads the signed
.zipfrom GitHub Releases, verifies the SHA-256 checksum, and installs the app. Review the script source before running.
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The skill metadata includes an install command that fetches a remote script and immediately executes it with bash. This creates a direct remote code execution path during installation: if the upstream GitHub content, repository, account, or network path is compromised, arbitrary code will run on the user's machine without prior inspection.
- Content
md description: Switch AI models and manage API keys for OpenClaw with a native macOS app. Supports 16 providers including OpenAI, Anthropic, xAI, Google, Groq, Ollama, LM Studio, and more. homepage: https://github.com/Gogo6969/clawapi user-invocable: true metadata: {"openclaw":{"emoji":"🔑","requires":{"bins":["curl"],"config":["skills.entries.clawapi"]},"install":[{"kind":"script","command":"curl -fsSL https://raw.githubusercontent.com/Gogo6969/clawapi/main/install.sh | bash"}]}} --- # ClawAPI — Model Switcher & Key Vault for OpenClaw
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The documentation instructs users to run a curl-to-bash install command, which is an unsafe installation pattern even if the referenced script currently performs checksum verification later. The risk occurs before any script-internal validation, because untrusted remote code is already being executed by the shell.
- Content
Option 2: Install script
bash curl -fsSL https://raw.githubusercontent.com/Gogo6969/clawapi/main/install.sh | bashThe install script downloads the same signed
.zipfrom GitHub Releases, verifies the SHA-256 checksum, unzips it, and moves the app to/Applications. You can review the script source before running it.