T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:94- Finding
Unpinned Remote Repository Is Cloned and Its Installer Is Immediately Executed
- Content
View full analysis
Vulnerability Details
File Location:
README.md, lines 94–103
Vulnerability Type: Remote mutable payload retrieval and execution
Risk Level: HighComplete Code Snippet:
markdown One-line install for Codex: ```bash git clone https://github.com/huangrichao2020/uwillberich.git && cd uwillberich && ./install_skill.shOne-line install for OpenClaw:
bash git clone https://github.com/huangrichao2020/uwillberich.git && cd uwillberich && ./install_skill.sh openclawtext ### Technical Analysis The documented installation commands clone a mutable personal GitHub repository and immediately execute `install_skill.sh`. The installer is not included in the audited artifact, so its behavior and requested privileges cannot be assessed from this project snapshot. The command does not pin a reviewed commit, verify a cryptographic checksum, require a signed release, or provide an inspection step before execution. Consequently, the effective executable payload can change after the Skill has been reviewed. This creates a time-of-review versus time-of-installation supply-chain gap. GitHub is a legitimate code-hosting service, but that does not establish the integrity of future repository content. Compromise of the maintainer account, repository, release process, or default branch could turn the documented command into arbitrary local code execution. ### Attack Path 1. An attacker compromises the referenced GitHub account or repository, or otherwise obtains permission to modify its default branch. 2. The attacker replaces or modifies `install_skill.sh`, or another file invoked by that script, with a malicious payload. 3. A user or agent follows the documented one-line installation command. 4. `git clone` retrieves the attacker-controlled revision without pinning or integrity verification. 5. The shell immediately invokes `./install_skill.sh` with the installing user’s privileges. 6. The payload ...[truncated 978 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the clone-and-immediately-execute one-line commands.
- Include the complete installer in the reviewed Skill artifact so its behavior can be audited.
- Publish versioned releases and pin installation to a specific reviewed commit or immutable release artifact.
- Publish a SHA-256 digest through a separate trusted channel and require verification before execution.
- Sign release tags or artifacts and document signature verification.
- Separate retrieval from execution so users can inspect the installer:
bash git clone --branch vX.Y.Z --depth 1 https://github.com/huangrichao2020/uwillberich.git cd uwillberich # Verify the signed tag, commit, and documented checksum. less install_skill.sh ./install_skill.sh - Prefer a non-executable installation procedure that copies the already reviewed Skill directory into the target location.
- Document every filesystem location changed by the installer, all network access it performs, and whether it creates scheduled tasks or startup entries.
- Explicitly instruct users not to run the installer with
sudoor another elevated account.