T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:39
- Finding
- Unpinned Remote Repository and Dependency Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 39–42 **Vulnerability Type**: Remote payload retrieval and insecure dependency execution **Risk Level**: High **Vulnerable Code**: ```bash git clone https://github.com/openclaw-skills/ai-intelligent-3d-model-generation cd ai-intelligent-3d-model-generation pip install -r requirements.txt python app.py ``` ### Technical Analysis The documented installation process clones a mutable remote repository without pinning it to a reviewed commit, tag digest, or cryptographically verified release. It then installs dependencies from an unavailable `requirements.txt` and executes an unavailable `app.py`. Because neither the remote application nor its dependency manifest is included in the audited artifact, their behavior cannot be verified. The effective payload may change after this Skill has been reviewed. Moreover, `pip install` can execute package build or installation logic, while `python app.py` directly runs the downloaded application with the invoking user's permissions. The artifact supplies no commit hash, integrity checksum, signed release verification, dependency lockfile, package hashes, or source code corresponding to its advertised 3D-generation features. ### Attack Path 1. A user or AI agent follows the installation commands in `SKILL.md`. 2. Git clones the repository's current default branch rather than a fixed, previously reviewed revision. 3. An attacker who compromises the repository or a referenced dependency modifies `requirements.txt`, application files, or package installation behavior. 4. `pip install -r requirements.txt` retrieves and installs the attacker-controlled component; package build or installation hooks may execute code. 5. `python app.py` executes the mutable remote application directly. 6. The payload operates with the privileges and environment access of the user running the commands. ### Impact Assessment Successful e ...[truncated 654 chars]
- Remediation
- ## Remediation Suggestions 1. Include the complete reviewed implementation and dependency declarations within the Skill package so its executable behavior can be audited. 2. If remote retrieval is unavoidable, pin the repository to a specific verified commit hash rather than cloning a mutable default branch. 3. Distribute signed releases and verify signatures or cryptographic checksums before installation or execution. 4. Replace the unverified dependency manifest with a lockfile containing exact versions and package hashes, and install with hash verification enabled. 5. Review all direct and transitive dependencies for provenance, typosquatting, dependency confusion, known vulnerabilities, and unsafe installation hooks. 6. Do not automatically execute newly downloaded code. Require a separate verification and explicit approval step before running `app.py`. 7. Perform installation and execution in a least-privileged, isolated environment without sensitive credentials, host filesystem access, or unnecessary network access. 8. Keep the implementation, version metadata, dependency lockfile, and reviewed commit synchronized for each published Skill release.