T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:46
- Finding
- Mutable Remote Repository Is Retrieved and Its Automation Is Enabled Without Verification## Vulnerability Details **File Location**: `SKILL.md`, lines 46–51 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable instructions:** ```bash git clone https://github.com/sendwealth/claw-intelligence ``` The subsequent setup instruction directs the user to enable: ```text "Allow all actions" ``` ### Technical Analysis The Skill instructs users to clone a mutable external GitHub repository and then enable unrestricted GitHub Actions. No immutable commit, release digest, or verified artifact is specified. Consequently, the repository contents executed by a user may differ from those available when this Skill was audited. The local package contains only `SKILL.md`; the advertised workflows and monitoring scripts are not included. Their implementation, requested permissions, third-party Action references, secret handling, and executed commands therefore cannot be reviewed from the submitted artifact. This creates a remote payload execution channel: maintainers, compromised maintainer accounts, or attackers who gain control of the referenced repository could modify its workflows after publication. Enabling all Actions may also permit workflows to invoke unpinned third-party Actions, expanding the supply-chain attack surface. ### Attack Path 1. A user follows the Skill and clones `https://github.com/sendwealth/claw-intelligence`. 2. The user enables the GitHub setting labeled `"Allow all actions"`. 3. An attacker compromises the remote repository, a maintainer account, or an unpinned Action used by its workflows. 4. The attacker adds or modifies a workflow to execute attacker-controlled commands. 5. The workflow is triggered by an event such as an issue, push, schedule, or manual dispatch. 6. The malicious commands execute in the GitHub Actions runner with the workflow's configured `GITHUB_TOKEN` permissions and any secrets made available to that workflow. ### Impact ...[truncated 830 chars]
- Remediation
- ## Remediation Suggestions 1. Include all required workflows, scripts, templates, and configuration files directly in the reviewed Skill package. 2. If external retrieval is unavoidable, pin the repository to a reviewed immutable commit and verify the expected commit identifier before use. 3. Pin every third-party GitHub Action to a full commit SHA rather than a mutable branch or version tag. 4. Replace `"Allow all actions"` with an allowlist containing only reviewed Actions from explicitly trusted sources. 5. Define least-privilege workflow permissions, defaulting to: ```yaml permissions: contents: read ``` Grant write permissions only to individual jobs that demonstrably require them. 6. Do not expose production, deployment, or repository secrets to workflows triggered by untrusted events. 7. Require manual review before enabling workflows or accepting workflow changes. 8. Use protected branches, required code review, environment approvals, and CODEOWNERS protection for workflow files. 9. Document the exact reviewed repository commit, required permissions, triggers, external Actions, and secret requirements. 10. Add integrity and provenance controls, such as release checksums, signed commits or tags, and artifact attestations.