T03 · Remote Payload Retrieval and Execution
Error
- Location
- setup.sh:5
- Finding
- Unverified Remote Scripts and Python Payloads Are Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `setup.sh:5-6`, `setup.sh:66-99`; `examples/openclaw_setup.md:17-20`; `SKILL.md:133-142` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code From `setup.sh:5-6`: ```bash # Usage: # curl -fsSL https://botmark.cc/skill/setup.sh | bash ``` From `setup.sh:66-99`: ```bash else # Download from server info "Downloading skill files from botmark.cc..." TMPDIR=$(mktemp -d) trap "rm -rf $TMPDIR" EXIT curl -fsSL "https://botmark.cc/api/v1/bot-benchmark/skill?format=openclaw" -o "$TMPDIR/skill.json" # Extract files from JSON response python3 -c " import json, os, base64 with open('$TMPDIR/skill.json') as f: data = json.load(f) skill_dir = '$TMPDIR/botmark-skill' os.makedirs(skill_dir, exist_ok=True) # Write SKILL.md if 'skill_md' in data: with open(f'{skill_dir}/SKILL.md', 'w') as f: f.write(data['skill_md']) # Write engine if 'engine' in data: with open(f'{skill_dir}/botmark_engine.py', 'w') as f: f.write(data['engine']) # Write engine_meta if 'engine_version' in data: with open(f'{skill_dir}/engine_meta.json', 'w') as f: json.dump({'engine_version': data['engine_version'], 'skill_version': data.get('skill_version', '')}, f, indent=2) " || fail "Failed to extract skill files" SOURCE_DIR="$TMPDIR/botmark-skill" fi ``` From `examples/openclaw_setup.md:17-20`: ```bash Or download and run directly: ```bash curl -fsSL https://botmark.cc/skill/setup.sh | bash ``` ``` From `SKILL.md:133-142`: ```text 4. Process the response: - Save the `session_config` field as `session_config.json` - If `runner_script` is non-empty, save it as `botmark_engine.py` (update the engine cache) - Forward `owner_start_message` verbatim to the owner - If `skill_update` is included, process it according to the version-update section Engine cache: The installation already includes `botmark_engine.py`. Wh ...[truncated 2393 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | bash` installation instructions. 2. Publish immutable, versioned release archives and instruct users to download them before execution. 3. Publish a SHA-256 digest and a signature for every release. Verify both before extracting or executing any file. 4. Pin downloads to a specific release identifier rather than a mutable API endpoint. 5. Remove `runner_script` and executable `engine` fields from runtime API responses. 6. Treat engine updates as ordinary package upgrades requiring explicit owner approval. 7. If runtime updates are unavoidable, require an offline-pinned public key, verify a detached signature over the exact payload, enforce a strict version policy, and fail closed on verification errors. 8. Execute the engine in a sandbox with no unnecessary filesystem access, no inherited secrets, and network access restricted to explicitly required endpoints. ]]>