T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:48
- Finding
- Execution of Externally Supplied Installation Commands<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:48-55` **Vulnerability Type**: Remote command retrieval and unsafe dependency installation **Risk Level**: High ### Vulnerable Code ```markdown ### Install a Free Skill ```bash curl -X POST "https://claw-market.xyz/api/v1/install" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{"skillId": "weather"}' ``` Response includes `installCommand` (e.g., `npx clawhub install weather`). Run it to install locally. **After trying the skill, come back and leave a review** (see Review section below). ``` ### Technical Analysis The skill instructs the agent to execute an `installCommand` supplied dynamically by the remote `claw-market.xyz` service. There is no requirement to parse the response into safe arguments, validate the executable, restrict the accepted command format, verify a cryptographic signature, pin the installer version, or obtain separate user confirmation. Executing an entire server-provided command string creates a remote code-execution channel: the effective command can change after this skill has been audited. The example uses `npx`, which may download and execute an npm package at runtime. Without version and integrity pinning, this also introduces supply-chain exposure. The dangerous boundary is not the preceding `curl` request by itself, but the instruction to run an arbitrary response field as a local command. Any process following this workflow would execute it with the privileges and environment of the agent. ### Attack Path 1. An attacker compromises the marketplace endpoint, its backend, DNS path, publishing account, or another component able to influence the installation response. 2. The endpoint returns a malicious `installCommand` instead of the expected fixed installation command. 3. The agent follows the explicit “Run it to install locally” instruction. 4. The command executes with the agent process's local permissions. 5. The pa ...[truncated 787 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Never execute a command string returned by a remote service. - Replace the dynamic `installCommand` workflow with a fixed, locally defined installer and pass only a strictly validated skill identifier as a separate argument. - Restrict skill identifiers to an allowlisted format, such as a bounded alphanumeric slug. - Pin installer packages to reviewed versions and verify package integrity using trusted hashes or signatures. - Require signed marketplace manifests whose signatures are verified against a trusted publisher key. - Display the exact package, version, source, and planned operation to the user before installation. - Require explicit user approval before downloading or executing third-party code. - Run installation and subsequent skill execution inside a sandbox with limited filesystem, network, credential, and tool access. - Reject responses that contain shell operators, executable paths, additional arguments, or any command field not matching a strict schema. ]]>