T08 · Insecure Dependencies
Error
- Location
- SKILL.md:35
- Finding
- Execution of Unpinned Code from an External Repository<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 35-36 and 52-57 **Vulnerability Type**: Unpinned external dependency execution **Risk Level**: High ### Vulnerable Code ```markdown 2. Confirm RoughCut repo is present on the same Mac. - Repo: https://github.com/samerGMTM22/OpenClaw-RoughCut ``` ```bash bash "$REPO_ROOT/scripts/openclaw/roughcut.sh" \ --video "$VIDEO_ABS_PATH" \ --out "$OUTPUT_ROOT" \ --remove-bad-takes true \ --remove-fluff false ``` ### Technical Analysis The skill instructs the agent to execute `scripts/openclaw/roughcut.sh` from a separately obtained GitHub repository. It does not require a specific commit, immutable release, cryptographic checksum, digital signature, or other integrity verification before execution. The executable behavior of this skill is therefore not fully represented by the audited package. The external repository can change independently after this skill has been reviewed. In addition, the configured `repo_root` could refer to a modified or substituted local checkout. Although the documented shell variables are quoted, which reduces direct shell-injection risk through those arguments, quoting does not establish the trustworthiness or integrity of the external script itself. ### Attack Path 1. An attacker compromises the referenced repository, distributes a modified checkout, or causes `repo_root` to point to an attacker-controlled directory. 2. The malicious checkout supplies a modified `scripts/openclaw/roughcut.sh`. 3. The agent follows the skill instructions and invokes the script using Bash. 4. The modified script executes arbitrary commands with the privileges of the OpenClaw process. 5. Those commands can access resources available to that process, including local input videos, configured output locations, and environment variables such as `GEMINI_API_KEY` when present. This path requires compromise, substitution, or unsafe selection of the external repository; the review ...[truncated 879 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bundle the reviewed runner and its required implementation inside the skill package so its executable behavior is included in security review. 2. If the external repository must remain separate, require an immutable, audited commit hash rather than a branch or mutable release reference. 3. Before execution, verify: - The repository's expected remote origin. - The exact checked-out commit. - A published SHA-256 checksum or a cryptographically verified signature. - That the working tree contains no unreviewed modifications. 4. Refuse execution when the repository path, commit, signature, checksum, or working-tree state does not match the approved values. 5. Run the script with least privilege and restrict access to only the required input and output directories. 6. Provide `GEMINI_API_KEY` only when fluff removal is explicitly enabled, avoid exporting it globally, and use a narrowly scoped or dedicated key where supported. 7. Document whether transcripts or other derived media content are transmitted to Gemini, including the relevant privacy and retention implications. 8. Pin and verify the runner's downstream package dependencies and external tools to reduce transitive supply-chain exposure. ]]>