T03 · Remote Payload Retrieval and Execution
- Location
SKILL.md:19- Finding
Unpinned Remote Payload Retrieval and Execution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:19-25
Vulnerability Type: Remote code retrieval from mutable third-party sources
Risk Level: HighVulnerable Code
bash # Docker (recommended) git clone https://github.com/loserbcc/openclaw-gateway.git cd openclaw-gateway docker compose up # Or Python pip install openclaw-gateway openclaw-gatewayTechnical Analysis
The installation instructions retrieve and immediately execute third-party code without pinning it to a reviewed commit, immutable container digest, or exact Python package version. No checksum, signature, lock file, or other provenance-verification mechanism is specified.
The effective executable payload can therefore change after this Skill has been reviewed. In the Docker path,
docker compose upprocesses configuration from the newly cloned repository and may build or run remotely sourced images and code. In the Python path,pip install openclaw-gatewayinstalls the currently resolved package release, which is then immediately executed.The remote repository and Python package implementation are not included in this project, so the audit cannot verify their current or future behavior. This finding does not establish that the referenced project is malicious; it identifies the unsafe trust and execution model documented by the Skill.
Attack Path
- An attacker compromises the referenced GitHub repository, Python package publisher account, dependency chain, or associated container-image source.
- The attacker modifies a mutable branch, publishes a malicious package release, or substitutes an image used by the Compose configuration.
- A user follows the Quick Start instructions after the compromise.
- The user retrieves the unverified current payload through
git clone,pip install, or a container-image pull. docker compose uporopenclaw-gatewayexecutes the attacker-controlled payload.- The paylo ...[truncated 862 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin the Git repository to a reviewed release tag and full commit hash rather than cloning and executing the default branch.
- Pin the Python package to an exact audited version, such as
openclaw-gateway==X.Y.Z, and verify package hashes using a locked requirements file with hash enforcement. - Publish cryptographic checksums or signatures and document how users must verify them before execution.
- Reference container images by immutable SHA-256 digest rather than mutable tags.
- Vendor or include the reviewed Compose configuration in the Skill package when practical.
- Review and document all volume mounts, host-network settings, environment variables, Linux capabilities, device mappings, and privileged-container settings.
- Run the gateway as a dedicated unprivileged account with a read-only filesystem and the minimum necessary network and filesystem access.
- Separate download, verification, and execution into distinct documented steps so users do not immediately execute unverified content.