T03 · Remote Payload Retrieval and Execution
Error
- Location
- scripts/install.sh:35
- Finding
- Unverified Remote Skill Payload Installation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install.sh:35-70` **Vulnerability Type**: Unverified remote payload retrieval and installation **Risk Level**: Critical ### Vulnerable Code ```bash # Step 2: Download skill package echo "Downloading $skill_name from ClawHub..." download_url="https://wry-manatee-359.convex.site/api/v1/download?slug=${skill_name}" zip_path="/tmp/${skill_name}.zip" if curl -L -o "$zip_path" "$download_url" --fail --silent --show-error; then echo "Downloaded successfully" else echo -e "${RED}Error: Failed to download ${skill_name}. The skill may not exist or rate limited.${NC}" rm -f "$zip_path" return 1 fi # Check if zip file is valid if [ ! -s "$zip_path" ]; then echo -e "${RED}Error: Downloaded file is empty${NC}" rm -f "$zip_path" return 1 fi # Step 3: Extract to workspace/skills skills_dir="$workspace_path/skills" target_dir="$skills_dir/$skill_name" echo "Extracting to $target_dir..." # Create skills directory if not exists mkdir -p "$skills_dir" # Remove existing skill if it exists if [ -d "$target_dir" ]; then echo "Removing existing $skill_name..." rm -rf "$target_dir" fi # Create the skill directory mkdir -p "$target_dir" # Extract the zip if unzip -q "$zip_path" -d "$target_dir"; then ``` ### Technical Analysis The installer downloads a mutable archive from an external server and extracts it directly into OpenClaw's active `skills` directory. The only content validation is a nonempty-file check. It does not verify a cryptographic signature, a trusted publisher identity, a pinned digest, or an expected package manifest. The use of `curl -L` also allows redirects without validating that the final destination remains an approved host. The effective Skill content can therefore change after this installer has been reviewed. A compromise of the download service, its delivery infrastructure, or an allowed redirect target could replace a legitimate Skill with attacker-c ...[truncated 1597 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer the official, authenticated Skill distribution and installation mechanism rather than bypassing its controls. 2. Require each archive to have a cryptographic signature from an explicitly trusted publisher, and verify it before extraction. 3. Pin an expected cryptographic digest for every package version. Reject any archive whose digest does not match. 4. Disable unrestricted redirects or validate the scheme and hostname of the final URL against a strict allowlist. 5. Download into an isolated staging directory and validate the archive manifest and every contained file before installation. 6. Reject unexpected executable files, symlinks, device entries, and unsupported file types. 7. Present the package identity, version, publisher, digest, and requested permissions for explicit approval. 8. Move validated content atomically into the active Skill directory rather than extracting remote content there directly. 9. Preserve the previous trusted Skill until the replacement has passed all validation, enabling safe rollback. ]]>