T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:62
- Finding
- Unpinned Remote MCP Source Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 62–72 **Vulnerability Type**: Execution of mutable remote code through `npx` **Risk Level**: High ### Vulnerable Code ```bash openclaw mcp add wan3-video \ --command npx \ --arg -y \ --arg github:gpt-img-2/wan3-video-prompt-mcp \ --include 'build_wan3_video_prompt,plan_wan3_shot_sequence,diagnose_wan3_video_prompt,get_wan3_video_resources' ``` Then run `openclaw mcp doctor wan3-video --probe`. If the installed release does not expose an `mcp` command group, add `npx -y github:gpt-img-2/wan3-video-prompt-mcp` as a Stdio server in MCP settings. ### Technical Analysis The installation instructions direct `npx` to retrieve and execute code from the mutable GitHub reference `github:gpt-img-2/wan3-video-prompt-mcp`. The reference is not pinned to a reviewed commit hash, immutable release, or exact package version, and no integrity digest or signature verification is required. Because the effective payload is resolved when the command runs, changes made to the remote repository after this Skill was audited can change the locally executed code without requiring any modification to `SKILL.md`. The `-y` option also suppresses the normal installation confirmation, reducing the opportunity for users to inspect the resolved dependency before execution. The audit found no evidence that the currently referenced repository is malicious. The vulnerability arises from trusting and executing a mutable remote payload without integrity controls. ### Attack Path 1. An attacker compromises the referenced GitHub account or repository, takes over a dependency used by the repository, or otherwise gains the ability to alter the remotely resolved source. 2. The attacker adds malicious package lifecycle logic, MCP server initialization code, or runtime code to the remote project. 3. A user follows the documented setup command or configures the fallback Stdio command. 4. `npx -y` downloads the current re ...[truncated 1154 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the GitHub dependency to a reviewed immutable commit hash rather than the repository's current default branch. 2. Prefer an exact, trusted package release with a lockfile and verified integrity hash where the tooling supports it. 3. Remove `-y` from the documented command so installation requires explicit user confirmation. 4. Verify the source, release signature, dependency tree, and package lifecycle scripts before recommending execution. 5. Document the MCP server's required filesystem, environment-variable, credential, and network access. 6. Run the MCP server in a sandbox or container with: - A non-privileged account. - A read-only filesystem where practical. - No access to unrelated credentials or sensitive environment variables. - Restricted outbound network access. - Access only to explicitly required project directories. 7. Establish a controlled update process in which new upstream revisions are reviewed and the immutable pin is updated deliberately. 8. Provide the expected commit identifier and integrity verification steps directly in `SKILL.md` so users can confirm that the retrieved source matches the audited version. ]]>