T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:60
- Finding
- Execution of an Unpinned Remote Payload Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 60-70 **Vulnerability Type**: Mutable remote code retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash Connect the stdio server with: openclaw mcp add what-brandon-thinks \ --command npx \ --arg -y \ --arg github:gpt-img-2/whatbrandonthinks-chat-mcp \ --include 'build_chat_analysis_brief,score_interaction_signals,audit_chat_claim,get_what_brandon_thinks_resources' ``` Then run `openclaw mcp doctor what-brandon-thinks --probe`. If the installed release lacks the `mcp` command group, add `npx -y github:gpt-img-2/whatbrandonthinks-chat-mcp` as a Stdio server in MCP settings. The MCP is optional; never imply it ran when unavailable. ### Technical Analysis The installation instructions direct users to execute an MCP server fetched from a GitHub repository through `npx`. The GitHub dependency is not pinned to an immutable commit hash or a verified release artifact. Its effective payload can therefore change after this Skill has been reviewed. The `-y` argument automatically accepts installation prompts, reducing the opportunity for the user to inspect the package and its dependency changes before execution. The fetched software executes with the privileges of the user running OpenClaw or configuring the MCP server. The MCP implementation is not included in the audited project, so the assertions that it is read-only, does not upload transcripts, and does not access accounts cannot be independently verified from this artifact. ### Attack Path 1. An attacker compromises the referenced GitHub repository, its maintainer account, or an upstream dependency used by the MCP project. 2. The attacker changes the repository's default branch or referenced package content to include a malicious installation hook or runtime payload. 3. A user follows the documented command or configures the fallback Stdio server. 4. `npx -y` retrieves and ex ...[truncated 1197 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the MCP source to a reviewed immutable Git commit rather than the repository's mutable default branch. 2. Prefer a signed, versioned release artifact or package with a cryptographic integrity hash. 3. Remove `-y` so users can review installation prompts and dependency changes before execution. 4. Publish and audit a dependency lockfile, including transitive dependencies. 5. Vendor the reviewed MCP implementation into the audited distribution when feasible. 6. Document the exact files, environment variables, network endpoints, and data available to the MCP process. 7. Run the MCP under a sandboxed, least-privileged account with restricted filesystem and network access. 8. Add a verification procedure that checks the downloaded source or artifact against an expected commit and checksum before execution. 9. Re-audit the pinned MCP source and its dependencies before claiming that it is read-only or does not transmit transcripts.