T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:43
- Finding
- Unpinned Remote Code Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 43–46 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash git clone https://github.com/openclaw-skills/ai-intelligent-access-control cd ai-intelligent-access-control pip install -r requirements.txt python app.py ``` ### Technical Analysis The installation instructions clone a mutable remote repository without pinning a reviewed commit, tag, or signed release and without verifying its integrity. They then install dependencies from a remotely obtained `requirements.txt` and execute a remotely obtained `app.py`. Neither the referenced application files nor its dependency manifest are present in the audited artifact. The effective payload can therefore change after this Skill has been reviewed. A compromise or malicious modification of the repository's default branch could cause users following these instructions to execute arbitrary code. ### Attack Path 1. An attacker compromises the referenced repository, gains authority to modify it, or otherwise causes malicious content to be served from its mutable default branch. 2. The attacker modifies `requirements.txt`, a dependency, or `app.py`. 3. A user follows the documented commands and clones the modified repository. 4. `pip install -r requirements.txt` executes dependency installation behavior, or `python app.py` directly executes the modified application. 5. The malicious payload operates with the privileges and environmental access of the invoking user. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the invoking user's privileges. Depending on that user's permissions and environment, the payload could access or modify local files, credentials, application data, processes, and network-accessible resources. Given the advertised biometric and physical access-control purpose, a compromised implementation could also expose sensit ...[truncated 127 chars]
- Remediation
- ## Remediation Suggestions - Include the executable source code and dependency manifests in the reviewed Skill package. - Pin the remote source to an immutable, reviewed commit hash or a cryptographically signed release rather than a mutable default branch. - Verify release signatures or trusted cryptographic checksums before installation or execution. - Document the expected repository identity and commit digest so users can independently validate the retrieved content. - Execute the application under a dedicated least-privileged account and within an isolated environment. - Require a new security review whenever the pinned source revision changes.