T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:14
- Finding
- Mutable Remote Repository and Unpinned Dependencies Are Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 14–19 **Vulnerability Type**: Remote payload retrieval and execution through a mutable Git repository and unpinned npm packages **Risk Level**: High **Vulnerable Code**: ```bash git clone https://github.com/nachtsheim/openclaw-outlook-addin.git cd openclaw-outlook-addin npm install npx office-addin-dev-certs install # first time only npm run dev # starts https://localhost:3000 ``` ### Technical Analysis The installation instructions retrieve the current contents of an external GitHub repository without pinning a reviewed commit, release artifact, or cryptographic digest. The effective code executed by users can therefore change after this Skill has been reviewed. The subsequent `npm install` command installs dependencies from the retrieved project and may execute npm lifecycle scripts. Neither the dependency manifest nor a lockfile is present in the audited project, so dependency names, versions, integrity records, and installation scripts cannot be verified. The unversioned `npx office-addin-dev-certs install` command may download and execute a package version selected at installation time. It also installs development certificates, potentially changing the user's local certificate trust configuration. Finally, `npm run dev` executes a script defined entirely by the mutable remote repository. This finding does not establish that the referenced repository or npm packages are malicious. It establishes that the documented workflow creates an unreviewed remote code-execution channel and an unsafe dependency trust boundary. ### Attack Path 1. An attacker compromises the referenced GitHub repository, one of its maintainers, an npm dependency, or an applicable package-publishing account. 2. The attacker adds malicious code to repository scripts, npm lifecycle hooks, the development server command, or a dependency release. 3. A user ...[truncated 1476 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the external repository to a specific, reviewed commit hash rather than cloning and executing the mutable default branch. 2. Prefer a signed release artifact and publish its expected SHA-256 digest or signature-verification procedure. 3. Include the reviewed implementation and dependency metadata in the Skill package where practical, so the effective payload is available during auditing. 4. Commit a dependency lockfile with integrity records and replace `npm install` with `npm ci`. 5. Pin the exact version of `office-addin-dev-certs` instead of relying on unversioned `npx` resolution. Install it from a configured trusted registry and verify package provenance. 6. Audit all npm lifecycle scripts and consider installing dependencies with scripts disabled until required scripts have been separately reviewed. 7. Document every certificate-store modification, the permissions it requires, its security implications, and a procedure for removing the installed certificate. 8. Run the development server and build process as an unprivileged account in an isolated environment with restricted filesystem, credential, network, Outlook, and Gateway access. 9. Require explicit user review and confirmation before granting the add-in access to email content or exposing agent tools and automations. 10. Add an origin allowlist scoped to the exact required development origin and avoid broadly exposing the local Gateway.