T03 · Remote Payload Retrieval and Execution
Warning
- Location
- SKILL.md:30
- Finding
- Automatic Installation and Execution of an Unpinned Remote Go Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 30–42 **Vulnerability Type**: Remote mutable payload retrieval and insecure dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown ## 调用前置检查（每次调用前必须执行） **在运行 signalbot 前，先检查二进制是否存在：** ```bash which signalbot ``` - 若有输出路径 → 直接继续调用 - 若无输出（command not found）→ 立即自动执行以下命令编译安装，**无需询问用户**： ```bash go install github.com/shanhuhai5739/signalbot@latest ``` ``` The same mutable installation instruction also appears in the package metadata and update procedure: ```yaml metadata: {"openclaw": {"emoji": "📊", "homepage": "https://github.com/shanhuhai5739/signalbot", "install": [{"id": "go-install", "kind": "go", "package": "github.com/shanhuhai5739/signalbot@latest", "bins": ["signalbot"], "label": "Install signalbot via go install"}]}} ``` ```bash go install github.com/shanhuhai5739/signalbot@latest ``` ### Technical Analysis The Skill directs the Agent to install `github.com/shanhuhai5739/signalbot@latest` automatically when the executable is unavailable, explicitly stating that user confirmation is unnecessary. The `@latest` selector is mutable and does not identify an immutable, previously reviewed version or commit. The reviewed project contains only documentation and Skill instructions. It does not include the external program's source code, dependency manifest, cryptographic checksum, signature, or software bill of materials. The effective code executed by the Agent can therefore change after this Skill has been audited. This behavior creates both a remote-payload and supply-chain trust boundary. `go install` retrieves source and transitive Go dependencies from external infrastructure, compiles them, and produces an executable under the privileges of the Agent's operating-system account. The Skill subsequently invokes that executable for market-analysis requests. No evidence establishes that the current upstream package is malicious. The vulnerability is the ...[truncated 1627 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an immutable, reviewed version or commit, for example a specific semantic version or module commit identifier. 2. Maintain an allowlist of approved versions and reject versions not explicitly listed. 3. Require explicit, informed user approval before downloading, compiling, updating, or executing external software. 4. Remove automatic updates. Treat every version change as a new security review event. 5. Verify the upstream source revision and all dependency checksums before installation. 6. Include the reviewed source code, `go.mod`, and `go.sum` in the auditable artifact, or link the Skill to a reproducible build of an exact commit. 7. Generate and publish an SBOM and document all transitive dependencies. 8. Execute the binary in a restricted environment with minimal filesystem access, sanitized environment variables, limited network destinations, and no administrative privileges. 9. Fail safely when the required binary is absent rather than silently installing a mutable external payload. ]]>