T03 · Remote Payload Retrieval and Execution
Warning
- Location
- SKILL.md:57
- Finding
- Unpinned Retrieval and Execution of External Code and Dependencies## Vulnerability Details **File Location**: `SKILL.md:57-61`; duplicated in `INSTALL.md:6-20` **Vulnerability Type**: Remote mutable code retrieval and insecure dependency installation **Risk Level**: Medium ### Vulnerable Code `SKILL.md:57-61`: ```bash git clone https://github.com/Shuai-DaiDai/openclaw-skill-growth.git cd openclaw-skill-growth npm install npm run build npm run test ``` `INSTALL.md:6-20`: ```bash git clone https://github.com/Shuai-DaiDai/openclaw-skill-growth.git cd openclaw-skill-growth ``` ```bash npm install ``` ```bash npm run build npm run test ``` ### Technical Analysis The audited package is a documentation-only wrapper and does not contain the plugin implementation, a package manifest, a dependency lockfile, or executable scripts. Instead, it instructs users to clone the default state of an external Git repository and execute installation and npm scripts. The clone operation is not pinned to a reviewed commit hash or immutable, verified release artifact. Consequently, the code executed by users may differ from the code that existed when this wrapper was reviewed. In addition, `npm install` can retrieve mutable third-party packages and execute npm lifecycle scripts with the privileges of the installing user. No malicious upstream code or dependency was demonstrated in the available artifact. The vulnerability is the unsafe trust and execution model: the effective payload is external, mutable, and not verifiable from this package. ### Attack Path 1. An attacker compromises the referenced upstream repository, its default branch, a maintainer account, or a transitive npm dependency. 2. The attacker introduces malicious code into a build, test, lifecycle, or other npm script. 3. A user follows the documented installation instructions and clones the current default branch without verifying a commit or release signature. 4. The user runs `npm install`, which may exec ...[truncated 921 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the upstream source to a reviewed full commit hash rather than cloning and executing the mutable default branch. 2. Prefer an immutable release archive and publish its SHA-256 checksum or cryptographic signature. Require users to verify it before execution. 3. Include a committed dependency lockfile in the upstream project and instruct users to run `npm ci` rather than unconstrained `npm install`. 4. Review and document all npm lifecycle scripts. Where compatible with the project, install dependencies using `npm ci --ignore-scripts`, then explicitly run only reviewed scripts. 5. Pin automated installation references to immutable dependency versions and use dependency integrity verification. 6. Document that build, test, and apply commands execute external code and should run in an isolated, least-privilege environment without unnecessary secrets. 7. Package the reviewed implementation with the skill where feasible, or include sufficient manifests and source material to permit the effective payload and dependency graph to be audited. 8. Require explicit review and backups before any apply workflow is granted write access to real skill directories.