T03 · Remote Payload Retrieval and Execution
Warning
- Location
- SKILL.md:20
- Finding
- Unpinned Remote Payload Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 20–33 **Vulnerability Type**: Remote payload retrieval without version pinning or integrity verification **Risk Level**: Medium ### Vulnerable Code Snippet ```bash openclaw skills install codex-cn-bridge /codex-cn-bridge install ``` Alternative installation path: ```bash git clone https://github.com/luckKiven/codex-cn-bridge.git cp -r codex-cn-bridge ~/.openclaw/workspace/skills/ ``` ### Technical Analysis The audited package contains only `SKILL.md`; the proxy implementation and supporting scripts described by the documentation are not included. Instead, users are instructed to run an installer that automatically downloads the complete implementation or clone the repository's mutable default branch. Neither installation path pins the retrieved payload to an immutable commit or release, verifies a cryptographic checksum or signature, or otherwise validates the downloaded files before use. The effective code executed by users can therefore change after this Skill has been reviewed. The absent implementation reportedly includes `proxy.py`, `models.yaml`, and `start.bat`. Because these files are fetched after installation, their behavior—including handling API keys, modifying Codex configuration, and processing prompts—cannot be verified from the audited artifact. ### Attack Path 1. An attacker compromises the upstream repository, package registry entry, maintainer account, default branch, or remote installation infrastructure. 2. The attacker modifies the remotely hosted installer or proxy implementation. 3. A user follows `SKILL.md` and invokes `/codex-cn-bridge install`, or clones the mutable repository without specifying a trusted commit. 4. The altered implementation is downloaded without signature or checksum validation. 5. The user configures provider API keys and starts the downloaded proxy. 6. The malicious payload executes locally and can access data made available to the bridge, ...[truncated 1011 chars]
- Remediation
- ## Remediation Suggestions 1. Bundle the complete proxy implementation and all startup or configuration scripts directly in the reviewed Skill package. 2. If remote retrieval is necessary, pin every download to an immutable release artifact or exact Git commit rather than a mutable branch. 3. Publish SHA-256 or stronger hashes for all downloaded artifacts and verify them before extraction or execution. 4. Add cryptographic release signing and validate signatures against a documented, trusted maintainer key. 5. Display every download URL, resolved version, and expected digest before installation, and require explicit user confirmation. 6. Fail closed if integrity or signature verification cannot be completed. 7. Avoid automatically executing newly downloaded files; separate retrieval, verification, inspection, and execution into distinct steps. 8. Include the fetched `proxy.py`, `models.yaml`, startup scripts, and installer logic in future security reviews. 9. Run the bridge with minimum user privileges and restrict its access to credential and configuration files that are strictly required. 10. Document repository ownership, release provenance, update behavior, and a secure rollback process.