T03 · Remote Payload Retrieval and Execution
Error
- Location
- README.md:94
- Finding
- Unpinned Remote Repository Is Cloned and Immediately Executed<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 94-103 **Vulnerability Type**: Remote payload retrieval and execution through an unpinned Git repository **Risk Level**: High ### Vulnerable Code ```bash One-line install for Codex: git clone https://github.com/huangrichao2020/uwillberich.git && cd uwillberich && ./install_skill.sh One-line install for OpenClaw: git clone https://github.com/huangrichao2020/uwillberich.git && cd uwillberich && ./install_skill.sh openclaw ``` ### Technical Analysis The documented installation commands clone the current default branch of a personal GitHub repository and immediately execute `install_skill.sh`. No immutable commit hash, signed release, checksum, or local review step constrains the downloaded payload. Consequently, the code executed by these commands is not necessarily the same code that was reviewed in this audit. The effective installation payload can change whenever the repository owner updates the default branch. It could also change if the repository, maintainer account, access token, or release process is compromised. The `&&` chain causes the installer to run automatically after a successful clone, eliminating a meaningful inspection boundary between retrieval and execution. Although this is a user-initiated installation command, it creates a direct remote code execution channel and exceeds the minimum trust necessary to copy a text-based Skill into an agent directory. No malicious implementation of `install_skill.sh` was present in the audited artifact, so this finding concerns the mutable remote execution mechanism rather than a confirmed malicious installer body. ### Attack Path 1. An attacker compromises the repository owner’s GitHub account, gains repository write access, or otherwise causes the default branch to serve a modified `install_skill.sh`. 2. The attacker adds commands to the installer that perform actions under the installing user’s account. 3. A user follows ei ...[truncated 1493 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Do not clone and execute in one command.** Separate download, inspection, verification, and execution into distinct documented steps. 2. **Pin installation to an immutable revision.** For example: ```bash git clone https://github.com/huangrichao2020/uwillberich.git cd uwillberich git checkout --detach <reviewed-full-commit-hash> ``` The full commit hash should be published through a trusted release channel. 3. **Publish signed, versioned releases.** Prefer a tagged release whose Git tag or commit is cryptographically signed and whose signer identity is documented. 4. **Publish and verify checksums.** If distributing an archive, provide a SHA-256 digest through a separately protected channel and require verification before extraction or execution. 5. **Require installer inspection.** Document commands such as: ```bash sed -n '1,240p' install_skill.sh ``` Only execute the script after verification. 6. **Prefer a non-executable installation path.** Since the audited Skill consists of text resources and standard-library Python scripts, provide explicit copy commands from a verified local checkout rather than relying on an installer. 7. **Minimize installer permissions.** The installer should: - Never invoke `sudo`. - Write only to the selected Skill directory. - Avoid modifying shell startup files or unrelated agent configuration. - Avoid reading credentials. - Fail before making changes if destination paths are unexpected. 8. **Add release provenance.** Use a reproducible release process and publish build provenance or attestations so users can establish that the distributed artifact corresponds to the reviewed source. 9. **Document uninstall and changed files.** Clearly enumerate every path created or modified by installation so users can review and reverse the operation. ]]>