T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:29
- Finding
- Mutable ApeClaw Installer Is Downloaded and Executed Without Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29-32 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash # Works everywhere. Installs everything. You're welcome. 🦞 curl -fsSL https://raw.githubusercontent.com/simplefarmer69/ape-claw/main/install.sh | bash ``` ### Technical Analysis The documented preflight procedure downloads `install.sh` from the mutable `main` branch of a personal GitHub repository and pipes the response directly into Bash. The command does not pin a commit or release, verify a cryptographic signature or checksum, retain the script for inspection, or constrain its execution privileges. Consequently, the effective code executed by this skill is not the content that was available during the audit. The repository owner, a compromised GitHub account, or another party able to modify the branch could replace the installer at any time. This installation mechanism is not necessary for the skill's read-only quote, discovery, or simulation functionality. It grants externally controlled code the full privileges of the user running the agent. ### Attack Path 1. An attacker compromises the `simplefarmer69` GitHub account, gains write access to the repository, or otherwise causes `main/install.sh` to serve malicious content. 2. The attacker modifies the installer while preserving the expected URL. 3. An OpenClaw agent follows the documented “run once per session” preflight procedure. 4. `curl` retrieves the attacker-controlled response and passes it directly to Bash. 5. The payload executes with the agent process's user privileges. 6. The payload can inspect environment variables and local files, including credentials later required by the workflow, and can alter the host or install additional software. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running OpenClaw. This may permit theft of ...[truncated 529 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not pipe network responses directly into a shell. - Distribute the reviewed installer with the skill, or use an immutable, versioned release artifact. - Pin the source to a reviewed Git commit or release version rather than the mutable `main` branch. - Publish and verify a SHA-256 or stronger checksum obtained through an independent trusted channel. - Prefer signed release artifacts and verify the maintainer signature before execution. - Download the installer to a file, inspect and validate it, and only then execute it explicitly. - Run installation in an isolated, low-privilege environment without wallet keys, agent tokens, or unrelated credentials. - Separate read-only features from transaction execution so discovery and simulation do not require installing privileged wallet-capable software. ]]>