T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:39
- Finding
- Unpinned Remote Repository Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 39-42 **Vulnerability Type**: Remote payload retrieval and insecure dependency installation **Risk Level**: High ```bash git clone https://github.com/openclaw-skills/ai-intelligent-blockchain-platform cd ai-intelligent-blockchain-platform pip install -r requirements.txt python app.py ``` ### Technical Analysis The installation instructions clone a mutable external Git repository without pinning it to a reviewed commit hash, release tag, or verified artifact checksum. They then install packages from the remote repository's unavailable and unaudited `requirements.txt` file and execute its `app.py` file. Consequently, the code that users execute can differ from the content reviewed in this artifact. The audited package does not contain `requirements.txt`, `app.py`, or any other implementation files, so neither the application behavior nor its dependency chain can be verified locally. A compromised repository, malicious maintainer update, or unsafe dependency declaration could introduce arbitrary executable code after publication of the skill. Python package installation may itself execute code through package build backends or installation hooks. Running `python app.py` provides a second direct code-execution path. ### Attack Path 1. An attacker compromises the referenced GitHub repository, gains control of its publishing workflow, or otherwise causes malicious content to be served from the referenced mutable repository. 2. The attacker modifies `app.py`, `requirements.txt`, or a package referenced by the dependency manifest. 3. A user follows the documented installation commands. 4. `pip install -r requirements.txt` executes malicious package installation or build behavior, or installs a compromised dependency. 5. Alternatively or additionally, `python app.py` directly executes the attacker's modified application code. 6. The payload runs with the operating ...[truncated 551 chars]
- Remediation
- ## Remediation Suggestions - Include the complete application implementation and dependency manifests in the skill package so they can be audited together. - If external retrieval is unavoidable, pin the repository to a specific reviewed commit hash rather than cloning the mutable default branch. - Distribute release artifacts with cryptographic checksums or signatures and verify them before installation or execution. - Pin every Python dependency to an exact reviewed version and use a lockfile containing integrity hashes, such as hashes enforced by `pip --require-hashes`. - Review direct and transitive dependencies for malicious packages, dependency confusion, typosquatting, and known vulnerabilities. - Avoid immediately executing newly downloaded code. Require a separate verification and approval step. - Perform installation and execution in a sandboxed, least-privileged environment without unnecessary credentials, wallet secrets, filesystem access, or network access. - Document the exact reviewed revision and provide a reproducible build or deployment process.