T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:43
- Finding
- Unpinned Remote Payload Retrieval and Unsafe Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 43-46 **Vulnerability Type**: Remote payload retrieval and supply-chain exposure **Risk Level**: High ```bash git clone https://github.com/openclaw-skills/ai-intelligent-ar-vr-platform cd ai-intelligent-ar-vr-platform pip install -r requirements.txt python app.py ``` ### Technical Analysis The installation instructions clone an external Git repository and execute its application without pinning the repository to an immutable commit, tag digest, or verified release artifact. The effective application payload is not included in the audited skill package and may therefore change after this package has been reviewed. The instructions also install the remote repository's `requirements.txt` without any visible version constraints, cryptographic hashes, signature verification, or trusted-package policy. Python package installation can execute package build and installation hooks, so a malicious or compromised dependency may run code before `app.py` is launched. The local `skill.json` identifies the author as `yang1002378395-cmyk`, while the installation instructions reference the `openclaw-skills` GitHub organization. The audited files provide no provenance or ownership explanation connecting these identities. This discrepancy does not prove malicious behavior, but it makes independent source verification especially important. No malicious payload is embedded in the two audited files. The risk arises from retrieving, installing, and executing mutable code that is outside the reviewed artifact. ### Attack Path 1. An attacker compromises the referenced GitHub repository, gains control of its owner account, or causes users to retrieve a subsequently modified repository state. 2. Alternatively, the attacker compromises, replaces, or introduces a malicious Python dependency referenced by the remote `requirements.txt`. 3. A user follows the documented installation procedure and clones the repository with ...[truncated 1127 chars]
- Remediation
- ## Remediation Suggestions 1. Include the complete application source and dependency manifests in the skill package so they can be reviewed together. 2. If remote retrieval is unavoidable, pin the repository to a specific immutable commit SHA rather than cloning the mutable default branch. 3. Distribute signed release artifacts and verify their signatures or cryptographic checksums before installation or execution. 4. Pin every Python dependency to an exact reviewed version and use hashes, such as through a lock file or `pip install --require-hashes`. 5. Restrict package installation to approved package indexes and validate package names to reduce dependency-confusion and typosquatting risks. 6. Disable unnecessary dependency build isolation or installation scripts where feasible, and review packages that require native builds or setup hooks. 7. Document the relationship between the package author and the referenced GitHub organization so users can verify provenance. 8. Run retrieved software inside an isolated, least-privilege virtual environment or container with no unnecessary secrets, host mounts, or network access. 9. Perform a separate security review of the pinned remote source, `requirements.txt`, resolved dependency tree, and `app.py` before publishing executable installation instructions.