T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:134
- Finding
- Unpinned Remote Source Retrieval and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:134-141`; related conflicting installation instructions at `README.md:27-32` **Vulnerability Type**: Remote retrieval, compilation, and execution of mutable external source code **Risk Level**: High ### Vulnerable Code From `SKILL.md:134-141`: ```bash # Requires Go 1.24+ export PATH="/tmp/go/bin:$PATH" # or system Go git clone https://github.com/sirToby99/swipenode.git /tmp/swipenode-build cd /tmp/swipenode-build go build -o ~/.openclaw/workspace/skills/swipenode/swipenode . ``` Conflicting instructions from `README.md:27-32`: ```bash git clone https://github.com/Nefas11/swipenode.git cd swipenode go build -o swipenode . chmod +x swipenode ``` The package also instructs users to execute the resulting binary and register it as an MCP server: ```bash ~/.openclaw/workspace/skills/swipenode/swipenode extract --url <url> ~/.openclaw/workspace/skills/swipenode/swipenode install-mcp ``` ### Technical Analysis The installation process clones the mutable default branch of an external GitHub repository and immediately compiles it into a locally executable binary. It does not pin a reviewed commit, verify a cryptographic checksum, validate a release signature, or include the source code in the audited package. Consequently, the code ultimately executed can differ from the code present when the Skill documentation was reviewed. A repository compromise, malicious update, ownership transfer, or force-push could replace the effective payload without requiring any change to this Skill package. The source identity is also inconsistent: `SKILL.md` references `sirToby99/swipenode`, while `README.md` directs users to clone `Nefas11/swipenode`. This ambiguity increases the chance of retrieving an unintended or less trusted implementation. No executable source, dependency manifest, binary, checksum, or signature is included in the audited artifact. Therefore, the implementation's network behavior, handling o ...[truncated 1889 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Include the complete auditable source code in the Skill package rather than downloading mutable source during installation. 2. Select one canonical repository and make all repository URLs, credits, and installation instructions consistent. 3. Pin external retrieval to a specific reviewed commit hash or immutable signed release tag. 4. Publish a SHA-256 checksum for every distributed source archive and binary, and verify it before compilation or execution. 5. Sign releases and document signature verification using a trusted maintainer key. 6. Include dependency manifests and lock data so transitive Go dependencies can be audited and reproduced. 7. Prefer reproducible builds and publish build provenance or attestations linking binaries to reviewed source. 8. Require explicit user confirmation before `install-mcp` modifies Claude Desktop or other persistent configuration. 9. Document the exact files and configuration entries modified by MCP installation and provide an uninstall procedure. 10. Restrict outbound requests to explicitly authorized HTTP or HTTPS targets. Validate redirects and block loopback, private, link-local, and cloud metadata addresses by default unless the user deliberately authorizes internal-network access. 11. Warn users not to pass authentication headers or secrets unless required, and ensure logs and error messages redact sensitive header values. 12. Subject the actual source and compiled artifact to a separate security review before deployment because their behavior cannot be established from the documentation-only package. ]]>