T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:28
- Finding
- Unverified Remote WebAssembly Payload Download and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 28-42 **Vulnerability Type**: Remote payload retrieval and execution through an unpinned external artifact **Risk Level**: High ### Vulnerable Code ```markdown ```bash openclaw wasm-sandbox download \ "https://raw.githubusercontent.com/guyoung/wasm-sandbox-openclaw-skills/main/opencv/files/opencv-component.wasm" \ "~/.openclaw/skills/opencv/files/opencv-component.wasm" ``` ## Tool Use `wasm-sandbox-run` tool with the WASM file: ```javascript wasm-sandbox-run({ wasmFile: "~/.openclaw/skills/opencv/files/opencv-component.wasm", args: ["<operation>", ...args] }) ``` ``` ### Technical Analysis The Skill instructs users to download an executable WebAssembly component from the mutable `main` branch of an external personal GitHub repository and then execute that component with `wasm-sandbox-run`. The remote binary is not included in the audited project. The documentation does not pin the download to an immutable Git commit or release, specify an expected cryptographic digest, or require signature verification. Consequently, the payload executed by users can change after the Skill has been reviewed without requiring any modification to the audited files. Although the component is intended to run in a WebAssembly sandbox, the documentation directs users to expose local directories through `workDir` or `mapDir`. A compromised component could therefore operate on files available through those mappings. The operations reference also documents that outbound network access can be explicitly enabled, which could increase the impact if such permission is granted. ### Attack Path 1. An attacker compromises the external repository, its maintainer account, the publication workflow, or another mechanism capable of replacing the artifact on the mutable `main` branch. 2. The attacker replaces `opencv-component.wasm` with a malicious or backdoored WebAssembly component. 3. A user follows the S ...[truncated 1444 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Vendor the reviewed artifact** - Include the audited WebAssembly component in the Skill package rather than downloading it at runtime. - Review and rebuild the component from documented source code using a reproducible build process. 2. **Use an immutable source** - If remote retrieval is unavoidable, reference an immutable commit hash or versioned release artifact instead of the mutable `main` branch. - Prevent automatic updates to a newly published binary without a separate security review. 3. **Verify integrity before execution** - Publish an expected SHA-256 or stronger cryptographic digest in the Skill package. - Verify the downloaded file against that digest before placing it in the executable location. - Prefer signed release artifacts and validate the signature against a trusted, pinned signing key. 4. **Apply least-privilege directory mappings** - Create a dedicated temporary working directory containing only the files required for the current operation. - Do not map home directories, project roots, credential directories, or other sensitive paths. - Use read-only mappings for inputs where supported and separate writable output directories. 5. **Restrict network capabilities** - Keep outbound network access disabled for image-processing operations. - If network access is essential, allow only narrowly scoped hosts and document why each host is required. - Do not combine sensitive directory mappings with unnecessary outbound access. 6. **Constrain resource consumption** - Configure strict execution time, memory, file-size, and output-size limits. - Validate image dimensions and model sizes before exposing files to the component. 7. **Document provenance** - Record the source repository, immutable revision, build procedure, compiler/toolchain versions, artifact digest, and review status for every approved WASM release. ]]>