T08 · Insecure Dependencies
Error
- Location
fly-install.sh:100- Finding
Automatic Installation from an Unverified GitHub Search Result
- Content
View full analysis
/dev/null | \ jq -r '.items[]? | select(.name | ascii_downcase == "'"$(echo "$SKILL_NAME" | tr '[:upper:]' '[:lower:]')"'") | \ "\(.full_name)|\(.clone_url)"' 2>/dev/null) if [ -z "$repos" ]; then # 尝试更宽泛的搜索 repos=$(curl -s "${GITHUB_API}?q=${SKILL_NAME}+openclaw" 2>/dev/null | \ jq -r '.items[0]? | "\(.full_name)|\(.clone_url)"' 2>/dev/null) fi if [ -z "$repos" ] || [ "$repos" == "null|null" ]; then log_warn "GitHub 未找到匹配仓库" return 1 fi # 解析结果 local repo_full_name=$(echo "$repos" | head -1 | cut -d'|' -f1) local clone_url=$(echo "$repos" | head -1 | cut -d'|' -f2) if [ -z "$clone_url" ] || [ "$clone_url" == "null" ]; then log_warn "无法获取克隆地址" return 1 fi log_info "找到仓库: $repo_full_name" log_info "克隆地址: $clone_url" # 执行克隆 if git clone --depth 1 "$clone_url" "$SKILL_NAME" 2>&1 | tail -3; then if [ -f "$SKILL_NAME/SKILL.md" ]; then log_info "✅ GitHub 克隆成功!" return 0 else log_warn "克隆成功但缺少 SKILL.md" rm -rf "$SKILL_NAME" return 1 fi else log_error "GitHub 克隆失败" return 1 fi } ``` ### Technical Analysis The installer discovers a repository by submitting a user-provided skill name to GitHub search. If no exact repository-name match is returned, it broadens the search and unconditionally selects the first result with `.items[0]`. Search ranking is not a security boundary and does not establish that a repository is the official implementation of the requested skill. The code perfor ...[truncated 1841 chars]- Remediation
View remediation