T03 · Remote Payload Retrieval and Execution
Error
- Location
- clawvault_manager.py:29
- Finding
- Installation Executes Unverified Code from a Mutable Remote Branch<![CDATA[ ## Vulnerability Details **File Location**: `clawvault_manager.py:29-31, 184-185` **Vulnerability Type**: Mutable remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```python REPO_URL = "https://github.com/tophant-ai/ClawVault" CLAWVAULT_GITHUB_REF = "main" CLAWVAULT_GITHUB_SPEC = f"git+{REPO_URL}.git@{CLAWVAULT_GITHUB_REF}" ``` ```python print(f"📦 Installing latest ClawVault from GitHub ({CLAWVAULT_GITHUB_REF})...") result = self._pip_install(CLAWVAULT_GITHUB_SPEC) ``` The invoked helper executes pip inside the newly created virtual environment: ```python def _pip_install(self, *args: str) -> subprocess.CompletedProcess: """Run pip install inside the venv.""" return subprocess.run( [str(self.venv_python), "-m", "pip", "install", *args], capture_output=True, text=True, ) ``` ### Technical Analysis The installer retrieves ClawVault directly from the mutable GitHub `main` branch. A pip installation from a Git repository can execute package build and installation logic, including code defined by the retrieved project. The reviewed Skill therefore does not fully determine the code that will execute when a user invokes the installation command. No commit SHA, signed release, checksum, or package hash is used to bind installation to a reviewed artifact. Consequently, upstream code can change after this Skill version has been reviewed or published. Although the documentation explicitly discloses this behavior, disclosure does not eliminate the remote-code and supply-chain risk. This behavior is necessary only to install the upstream application; using a mutable branch is not necessary for the declared installation functionality. An immutable, verified release would provide the same functionality with substantially lower privilege and supply-chain exposure. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or the `main` branch workflow. 2. The ...[truncated 1085 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `main` with an immutable, audited commit SHA or signed release tag. 2. Prefer a published wheel with a pinned SHA-256 hash and install it using pip hash verification. 3. Verify release signatures or attestations before installation. 4. Pin transitive dependencies through a reviewed lockfile with hashes. 5. Fail closed if integrity or signature verification cannot be completed. 6. Separate downloading from execution and display the exact source revision for explicit user approval. 7. Run the installed proxy under a sandboxed service account with narrowly scoped filesystem and network permissions. 8. Provide an explicit update command rather than silently selecting the newest upstream branch during installation. ]]>