T08 · Insecure Dependencies
Error
- Location
- skill.md:88
- Finding
- Unverified Third-Party Agent Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `skill.md`, lines 88-125 **Vulnerability Type**: Third-party supply-chain compromise through unverified package retrieval **Risk Level**: High ### Vulnerable Code ```sh Free agent: curl -s https://api.agentplace.sh/marketplace/agents/<agent-id>/download Paid agent: curl -s -H "x-api-key: ak_xxxx" https://api.agentplace.sh/marketplace/agents/<agent-id>/download Example response: { "download_url": "https://cdn.agentplace.sh/agents/example.zip", "version": "1.0.0", "tier": "free" } Step 3 — Download agent package curl -sL "$download_url" -o /tmp/agent.zip Step 4 — Preview contents zipinfo -1 /tmp/agent.zip unzip -p /tmp/agent.zip SKILL.md > /tmp/agent-SKILL.md cat /tmp/agent-SKILL.md Step 5 — Final confirmation Install this agent now? (yes/no) Step 6 — Install locally unzip -qo /tmp/agent.zip -d /tmp/agent-preview/ mv /tmp/agent-preview ~/.openclaw/workspace/skills/<agent-id>/ rm /tmp/agent.zip ``` ### Technical Analysis The installation procedure trusts a `download_url` returned dynamically by the marketplace API and follows redirects through `curl -L`. It does not require the URL to belong to an approved origin and does not verify a cryptographic digest, signed manifest, publisher signature, or immutable package identity. Consequently, the package reviewed and installed is authenticated only by transport security at the URL ultimately contacted. A compromised marketplace API, CDN, publisher account, DNS path, or redirect destination could provide a package different from the expected artifact. The documented manual marketplace review is an administrative control and is not cryptographically bound to the downloaded bytes. Although the package is not immediately executed by these commands, it is installed into the OpenClaw skills directory. Its instructions or packaged components may subsequently be loaded or invoked with the permissions of the OpenClaw process. ### Attack Path 1. An ...[truncated 1197 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Return an immutable package version, SHA-256 digest, package size, and signed manifest from the metadata endpoint. 2. Verify the digest and a signature rooted in a trusted publisher or marketplace key before previewing or installing the archive. 3. Permit downloads only from an explicit HTTPS hostname allowlist. 4. Disable redirects or validate every redirect target, scheme, port, and resolved address before following it. 5. Bind the final user confirmation to the verified package name, version, publisher, and digest. 6. Reject packages whose verified identity differs between preview and installation. 7. Record provenance information so installed files can be traced to a specific signed release. 8. Perform independent static inspection of every archive member rather than relying solely on claimed marketplace review. ]]>