T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:43
- Finding
- Execution of Mutable, Unaudited Remote Code and Dependencies## Vulnerability Details **File Location**: `SKILL.md`, lines 43–46 **Vulnerability Type**: Remote payload retrieval and insecure dependency installation **Risk Level**: High ```bash git clone https://github.com/openclaw-skills/ai-intelligent-alerting-system cd ai-intelligent-alerting-system pip install -r requirements.txt python app.py ``` ### Technical Analysis The installation instructions clone an external Git repository without pinning it to a reviewed commit, release, or cryptographically verified artifact. The effective code executed by users can therefore change after this Skill has been reviewed. The downloaded repository's `requirements.txt` is subsequently passed to `pip`, and its `app.py` is executed. Neither file is included in the audited artifact, so their contents, dependency versions, package sources, installation hooks, and runtime behavior cannot be verified. Python packages may execute code during installation through build backends or legacy setup mechanisms, while `app.py` can perform arbitrary actions with the invoking user's privileges. The artifact does not itself contain an explicitly malicious payload. The vulnerability is the trust boundary violation created by retrieving and executing mutable, unaudited remote content without integrity controls. ### Attack Path 1. An attacker compromises the referenced GitHub repository, gains control of its publishing account, or causes an unsafe dependency to be added to its `requirements.txt`. 2. The attacker inserts malicious behavior into `app.py`, a local packaging component, or a dependency installation hook. 3. A user follows the documented instructions and clones the repository's current default branch. 4. `pip install -r requirements.txt` downloads and installs the attacker-selected dependencies; package build or installation logic may execute at this stage. 5. The user runs `python app.py`, directly executing the downloaded application. 6. Th ...[truncated 1018 chars]
- Remediation
- ## Remediation Suggestions 1. Include the complete implementation and dependency manifests in the reviewed Skill artifact so that the installed code matches the audited code. 2. Pin the external repository to an immutable, reviewed commit rather than cloning a mutable default branch. 3. Verify downloaded source archives or commits using trusted signatures or cryptographic hashes before executing them. 4. Pin every Python dependency to an exact reviewed version and use a lock file containing hashes, such as a hash-locked requirements file. 5. Restrict package retrieval to explicitly trusted indexes and review the full transitive dependency tree for dependency confusion, typosquatting, and compromised releases. 6. Install and run the application in an isolated virtual environment or container under a dedicated, minimally privileged account. 7. Prevent unnecessary access to credentials, host files, and internal networks through filesystem, environment, and network sandboxing. 8. Re-audit `app.py`, `requirements.txt`, package build configuration, and all executable installation hooks before deployment.