T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:38
- Finding
- Unpinned Remote Payload Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 38-41 **Vulnerability Type**: Remote payload retrieval followed by dependency installation and code execution **Risk Level**: High ```bash git clone https://github.com/openclaw-skills/ai-intelligent-3d-model-generation cd ai-intelligent-3d-model-generation pip install -r requirements.txt python app.py ``` ### Technical Analysis The distributed skill artifact contains no implementation of its advertised functionality. Instead, its installation instructions direct users to clone a remote Git repository without specifying a commit hash or signed release, install dependencies declared by that remote payload, and execute its application. Because the cloned revision is not pinned, the effective code can change after this skill has been reviewed. The contents of `requirements.txt` are also unavailable in the audited artifact, preventing verification of package names, versions, sources, hashes, and transitive dependencies. Both Python package installation and direct execution of `app.py` can run arbitrary code. This creates a mutable remote execution channel. A compromise of the repository, its maintainer account, the default branch, or a resolved dependency could turn the documented installation process into arbitrary code execution. No malicious remote content can be confirmed from the supplied files; the vulnerability is the unauditable and unpinned retrieval-and-execution design. ### Attack Path 1. An attacker compromises the referenced repository, a maintainer account, or one of the dependencies resolved by its `requirements.txt`. 2. The attacker places malicious logic in the default branch, `app.py`, a dependency declaration, or a package installation hook. 3. A user follows the instructions and executes `git clone` without selecting a trusted commit or verified release. 4. `pip install -r requirements.txt` retrieves packages and may execute attacker-controlled ...[truncated 1011 chars]
- Remediation
- ## Remediation Suggestions 1. Include the complete implementation and dependency manifests in the reviewed skill package so the effective payload can be audited before execution. 2. If remote retrieval is unavoidable, pin the repository to a specific, reviewed commit hash rather than cloning a mutable default branch. 3. Publish signed releases and verify the signature and cryptographic checksum before installing or executing downloaded content. 4. Lock all direct and transitive Python dependencies to exact versions and require hashes, such as through a reviewed lock file and `pip install --require-hashes`. 5. Restrict package indexes to explicitly trusted sources and review packages for dependency confusion, typosquatting, and unsafe build hooks. 6. Run installation and application execution inside a least-privileged, isolated environment with no unnecessary credentials, host mounts, or unrestricted network access. 7. Separate download, verification, dependency installation, and execution into explicit steps that fail closed when integrity checks do not pass. 8. Re-audit the pinned source and dependency lock file whenever the approved revision changes.