T08 · Insecure Dependencies
Error
- Location
SKILL.md:65- Finding
Unverified Third-Party Archives Are Extracted into the Active Skills Directory
- Content
View full analysis
/download" # Paid curl -s -H "x-api-key: ak_xxxx" "https://api.agentplace.sh/marketplace/agents//download" ``` 3. Show the user a preview of the SKILL.md content 4. User approves → download and extract: ```sh curl -sL "$download_url" -o /tmp/agent.zip unzip -qo /tmp/agent.zip -d ~/.openclaw/workspace/skills/ rm /tmp/agent.zip ``` Or use the helper: `./install.sh [--api-key ak_xxxx]` ``` ### Technical Analysis The installation procedure obtains a mutable download URL from an external marketplace and then follows redirects with `curl -L` to retrieve a ZIP archive. The archive is extracted directly into the live OpenClaw skills directory without cryptographic signature verification, a pinned digest, download-host validation, or archive-entry validation. Although the workflow requires user approval and previews `SKILL.md`, it does not require inspection of supporting scripts, configuration files, binaries, symbolic links, or other content included in the archive. Consequently, the reviewed prompt may differ materially from the package's complete effective payload. The extraction command also does not explicitly reject path-traversal entries, symbolic links, or files that overwrite existing content. The fixed shared temporary path `/tmp/agent.zip` introduces an additional unsafe temporary-file concern where local adversarial interference is possible. ### Attack Path 1. An attacker compromises a marketplace publisher account, package repository, API response, download service, or redirect destination. 2. The attacker supplies a ZIP archive cont ...[truncated 1319 chars]- Remediation
View remediation