T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:40- Finding
Mutable and Unpinned Third-Party Code Installation
- Content
View full analysis
**Note:** `openclaw plugins install` does **not** accept GitHub URLs directly — only npm specs, local directories, or archives are supported. You must clone the repo first, then install from the local path. ### 1. Clone or update the plugin repository If the plugin has not been cloned yet: git clone https://github.com/motse-ai/luckee-openclaw-plugin.git /tmp/luckee-openclaw-plugin If the plugin directory already exists, pull the latest changes: cd /tmp/luckee-openclaw-plugin && git checkout main && git pull --ff-only origin main && cd - ### 2. Install the plugin from the local directory openclaw plugins install /tmp/luckee-openclaw-plugin ``` `SKILL.md:169-176`: ```bash **Step 2 — If not installed, install it:** python -m pip install --upgrade 'luckee-cli>=0.1.0' ``` `reference.md:103-106`: ```bash If all candidates fail and `autoInstallCli` is true (default), the plugin attempts: -m pip install --upgrade 'luckee-cli>=0.1.0' ``` ### Technical Analysis The installation procedure retrieves executable plugin code from the mutable `main` branch and installs it without pinning a reviewed commit, checking a cryptographic digest, or verifying a release signature. The `git pull` operation can therefore retrieve code that differs from the version originally reviewed. The Luckee CLI dependency is also specified only with a lower version bound, `luckee-cli>=0.1.0`. This permits pip to install any later matching version. According to `reference.md:17`, automatic CLI installation is enabled by default, allowing this dependency installation to occur when binary resolution fails. These behaviors create two related supply-chain risks: 1. The effective p ...[truncated 1945 chars]- Remediation
View remediation
=0.1.0` with an exact reviewed version such as `luckee-cli==X.Y.Z`. 5. Use pip hash verification, preferably through a locked requirements file with `--require-hashes`. 6. Set `autoInstallCli` to `false` by default. Require explicit user approval before installing or upgrading executable dependencies. 7. Separate installation from routine query execution so a missing binary cannot silently trigger a package upgrade. 8. Perform dependency updates through a controlled review process that includes source review, malware scanning, provenance validation, and regression testing. 9. Run the plugin under a restricted service account or sandbox with only the filesystem and network access required for its documented functionality. ]]>