T03 · Remote Payload Retrieval and Execution
Warning
- Location
scripts/run_video_query.sh:57- Finding
Mutable Remote Runtime Is Retrieved and Executed with API Credentials
- Content
View full analysis
/dev/null 2>&1 || { log_error "Failed to clone ${PINNED_REPO_URL} at tag ${PINNED_TAG}." log_error "Check network access and that the release tag exists." exit 2 } else ( cd "${MANAGED_RELEASE_DIR}" git fetch --depth 1 origin "refs/tags/${PINNED_TAG}:refs/tags/${PINNED_TAG}" >/dev/null 2>&1 || true git checkout --detach "${PINNED_TAG}" >/dev/null 2>&1 || { log_error "Failed to checkout pinned runtime tag ${PINNED_TAG}." exit 2 } ) fi ( cd "${MANAGED_RELEASE_DIR}" uv sync --frozen --no-dev >/dev/null 2>&1 || { log_error "Failed to install runtime dependencies with uv sync." exit 2 } ) } ``` ```bash main() { require_binary uv require_env_key GOOGLE_API_KEY require_env_key YOUTUBE_API_KEY RUNTIME_ROOT="$(resolve_runtime_root)" cd "${RUNTIME_ROOT}" uv run python -m video_sourcing_agent.integrations.openclaw_runner "$@" } main "$@" ``` ### Technical Analysis The Skill retrieves application code from an external Git repository and executes it on the host. Although the source is labeled as pinned to `v0.2.3`, a Git tag is not an immutable integrity identifier: an upstream maintainer or an attacker controlling the repository can move or replace t ...[truncated 2978 chars]- Remediation
View remediation