T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:42
- Finding
- Unpinned Remote Payload Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 42-45 **Vulnerability Type**: Remote code retrieval and execution **Risk Level**: High **Complete Code Snippet**: ```bash git clone https://github.com/openclaw-skills/ai-intelligent-after-sales-service cd ai-intelligent-after-sales-service pip install -r requirements.txt python app.py ``` ### Technical Analysis The installation instructions clone a mutable remote repository without pinning a reviewed commit or verifying its integrity. They then install packages from a remotely supplied `requirements.txt` and execute the remotely supplied `app.py`. Neither `requirements.txt` nor `app.py` is included in the audited artifact, which contains only `SKILL.md`. Consequently, the effective application payload and its dependency graph cannot be inspected or verified during this audit. The payload may change after the skill has been reviewed, while the instructions continue to retrieve and execute the latest remote version. Although dependency installation is also part of the exposure, the best matching classification is `T03: Remote Payload Retrieval and Execution` because the primary issue is the direct retrieval and execution of mutable external application code. There is no local evidence proving that the current remote repository is malicious. ### Attack Path 1. An attacker compromises the referenced GitHub repository, a maintainer account, or the repository's mutable default branch. 2. The attacker modifies `app.py`, `requirements.txt`, or another imported application component. 3. A user follows the documented installation commands and clones the attacker-controlled revision. 4. `pip install -r requirements.txt` may execute package build or installation logic supplied through the modified dependency manifest. 5. `python app.py` directly executes the retrieved application payload. 6. The payload runs with the privileges and environmental access of the user ...[truncated 763 chars]
- Remediation
- ## Remediation Suggestions 1. Include the complete application source and dependency manifests in the skill package so they can be reviewed together. 2. Pin the remote source to a specific, reviewed commit hash rather than cloning a mutable default branch. 3. Verify the downloaded source using a trusted cryptographic signature or a securely distributed checksum. 4. Pin every Python dependency to an exact version and require cryptographic hashes, for example with `pip install --require-hashes`. 5. Use a trusted package index and review transitive dependencies, package provenance, and installation scripts. 6. Install and run the application in an isolated, least-privileged virtual environment or container with restricted filesystem, credential, and network access. 7. Separate retrieval from execution and require an explicit source review or integrity-validation step before installing dependencies or launching the application.