T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:27
- Finding
- Unpinned Remote Skill Installation Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:27-36` **Additional Location**: `README.md:19-22` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash ### Option 2: From GitHub ```bash # Clone the repo git clone https://github.com/KaigeGao1110/language-coach.git ~/.openclaw/skills/language-coach # Or download directly curl -L https://github.com/KaigeGao1110/language-coach/archive/refs/heads/main.zip -o /tmp/language-coach.zip unzip /tmp/language-coach.zip -d ~/.openclaw/skills/ mv ~/.openclaw/skills/language-coach-main ~/.openclaw/skills/language-coach ``` ``` The README presents a similar unpinned installation method: ```bash # Via Git git clone https://github.com/KaigeGao1110/language-coach ~/.openclaw/workspace/skills/language-coach ``` ### Technical Analysis The documented installation procedures retrieve the current state of a mutable repository branch without pinning a reviewed commit or immutable release. Neither procedure verifies a cryptographic checksum or digital signature before placing the downloaded content into an Agent skills directory. The ZIP file is an archive rather than an executable binary, and the audited package contains no scripts or direct execution mechanism. The download URL also matches the homepage declared by the Skill, so the reviewed content does not establish typosquatting or intentional payload substitution. Nevertheless, installing mutable remote content means that the effective Skill loaded by a user may differ from the version that was audited. Use of `curl -L` additionally follows redirects without checking that the final destination remains on an expected host. If the repository, hosting account, release process, or redirect destination is compromised, an attacker could replace the Skill instructions or add new files before a subsequent installation. The optional remote installation workflow is not requi ...[truncated 1744 chars]
- Remediation
- ## Remediation Suggestions 1. Replace references to the mutable default branch with an immutable, reviewed release tag and preferably a full commit hash. 2. Publish a SHA-256 checksum for each release archive and verify it before extraction: ```bash curl --fail --show-error --location \ https://github.com/KaigeGao1110/language-coach/archive/refs/tags/v2.0.2.zip \ -o /tmp/language-coach-v2.0.2.zip echo "<EXPECTED_SHA256> /tmp/language-coach-v2.0.2.zip" | sha256sum --check - ``` 3. Sign releases and verify the signature against a documented, trusted maintainer key. 4. When using Git, check out and verify a specific commit or signed tag rather than accepting the repository's current default branch. 5. Validate the final URL after redirects, or avoid unrestricted redirects, to ensure the download remains on an approved HTTPS host. 6. Download and extract into a newly created private temporary directory rather than directly into the active skills directory. 7. Inspect the extracted archive for unexpected paths and reject symbolic links, absolute paths, and path-traversal entries before installation. 8. Install atomically only after integrity and content validation succeeds. 9. Keep the version declarations consistent: `SKILL.md` declares version `2.0.2`, while the README badge identifies `2.0.0`.