T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:36
- Finding
- Mutable Remote Payload Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 36-40 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High The installation instructions retrieve an unpinned external repository, install its unaudited dependencies, and execute its application: ```bash git clone https://github.com/openclaw-skills/ai-intelligent-attendance-management cd ai-intelligent-attendance-management pip install -r requirements.txt python app.py ``` ### Technical Analysis The audited package contains only `SKILL.md` and `skill.json`; it does not include the referenced `app.py`, `requirements.txt`, or any application implementation. The effective executable payload therefore resides in an external Git repository and can change after this Skill has been reviewed. The `git clone` command does not pin a commit hash or verify a signed release. Running `pip install -r requirements.txt` may execute package installation hooks, while `python app.py` directly executes the retrieved application. Neither the dependency identities and versions nor the application's behavior can be verified from the supplied artifact. ### Attack Path 1. An attacker compromises the referenced repository, a maintainer account, or an included Python dependency. 2. The attacker modifies `app.py`, `requirements.txt`, or a dependency installation hook to contain an unauthorized payload. 3. A user follows the documented installation procedure without checking out a trusted commit or verifying artifact signatures. 4. `pip install` executes malicious package build or installation logic, or `python app.py` executes the altered application. 5. The payload operates with the privileges and data access of the user who ran the commands. ### Impact Assessment Successful exploitation can provide arbitrary code execution under the invoking user's account. The resulting scope may include access to files, environment variables, credentials, networ ...[truncated 603 chars]
- Remediation
- ## Remediation Suggestions - Include the complete application source and dependency manifest in the reviewed Skill package. - Replace the mutable repository clone with a checkout pinned to a reviewed full commit hash or a cryptographically signed release. - Verify the repository identity, release signature, and downloaded artifact checksum before installation or execution. - Use a lock file containing exact dependency versions and cryptographic hashes, such as a hash-locked requirements file installed with `pip --require-hashes`. - Review direct and transitive dependencies for dependency confusion, typosquatting, known vulnerabilities, and unexpected installation hooks. - Run installation and application startup in an isolated, least-privileged environment without unnecessary credentials, sensitive filesystem access, or unrestricted network access. - Do not execute `app.py` until its contents and all imported local modules have been audited. - Ensure the packaged and externally published versions are reproducible from reviewed source.