T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:42
- Finding
- Mutable Remote Code Retrieval, Dependency Installation, and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 42-45 **Vulnerability Type**: Remote payload retrieval and insecure dependency execution **Risk Level**: High ### Vulnerable Code ```bash git clone https://github.com/openclaw-skills/ai-intelligent-api-management cd ai-intelligent-api-management pip install -r requirements.txt python app.py ``` ### Technical Analysis The skill package contains no application source code, `requirements.txt`, or `app.py` to support the advertised functionality. Instead, its installation instructions direct users to clone a mutable external Git repository, install its unspecified Python dependencies, and execute the downloaded application. No immutable commit reference, release checksum, signature, dependency lockfile, pinned package versions, or package hashes are specified. Consequently, the effective code executed by a user can differ from the content available when this skill was audited. The `pip install` operation may also execute package build or installation logic, including logic from transitive dependencies, before `app.py` is launched. This creates two related supply-chain risks: 1. The remote repository owner, a compromised maintainer account, or another party capable of modifying the repository can replace the retrieved application with arbitrary code. 2. An altered dependency manifest, unpinned package resolution, dependency confusion, or a compromised transitive dependency can introduce arbitrary installation-time or runtime code. ### Attack Path 1. An attacker compromises or otherwise gains modification access to the referenced remote repository, or compromises a dependency selected by its `requirements.txt`. 2. The attacker adds malicious Python code to `app.py`, a local package installation hook, or a direct or transitive dependency. 3. A user follows the documented commands without an immutable revision or integrity verification. 4. `git clone` retriev ...[truncated 1130 chars]
- Remediation
- ## Remediation Suggestions 1. Include the implementation and dependency manifest within the audited skill package so that the installed code matches the reviewed artifact. 2. If remote retrieval is unavoidable, reference an immutable commit hash or signed release rather than the repository's mutable default branch. 3. Publish and verify a cryptographic checksum or signature for every downloaded artifact before installation or execution. 4. Use a reproducible lockfile with exact direct and transitive dependency versions. 5. Require package hashes, such as through `pip install --require-hashes`, and retrieve packages only from an explicitly trusted index. 6. Review dependency provenance and guard against dependency confusion, typosquatting, compromised maintainers, and unsafe build hooks. 7. Separate retrieval, verification, installation, and execution into distinct steps. Do not immediately execute newly downloaded code. 8. Run installation and application startup in a sandbox or minimally privileged environment without unnecessary secrets, host filesystem access, or network permissions. 9. Align the package metadata before release: `SKILL.md` declares version `1.0.1`, while `skill.json` declares version `1.0.0`, and the files also identify different authors. Consistent provenance metadata will make artifact verification and release tracking more reliable.