T03 · Remote Payload Retrieval and Execution
Warning
- Location
- SKILL.md:39
- Finding
- Unpinned Remote Repository Retrieval and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 39–42 **Vulnerability Type**: Mutable remote payload retrieval followed by dependency installation and application execution **Risk Level**: Medium ### Vulnerable Code ```bash git clone https://github.com/openclaw-skills/ai-intelligent-backup-automation cd ai-intelligent-backup-automation pip install -r requirements.txt python app.py ``` ### Technical Analysis The documented installation procedure clones the mutable default branch of a remote Git repository without pinning it to a reviewed commit or verifying its integrity. It then installs dependencies from an unaudited `requirements.txt` file and executes an unaudited `app.py`. The executable application and dependency manifest are not included in the audited artifact, which contains only `SKILL.md` and `skill.json`. Consequently, the behavior of the remotely retrieved payload cannot be established from the reviewed package. The effective payload may change after this skill has been reviewed. The HTTPS transport protects data in transit but does not protect against compromise of the repository, maintainer account, dependency sources, or future malicious upstream changes. The subsequent `pip install` also creates a supply-chain exposure because Python package installation can execute package build logic. The instructions do not automatically execute the commands; exploitation requires a user or agent to follow the documented installation procedure. ### Attack Path 1. An attacker compromises the referenced repository, a maintainer account, or a dependency resolved by its `requirements.txt`. 2. The attacker modifies the default branch, `app.py`, the dependency manifest, or a referenced package so that malicious code executes during installation or startup. 3. A user or agent follows the installation commands in `SKILL.md`. 4. `git clone` retrieves the attacker-controlled content without selecting a previously reviewed commit. 5. `p ...[truncated 826 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Include the reviewed application source and dependency manifest directly in the distributed skill package. 2. If remote retrieval is necessary, check out an immutable, reviewed commit hash rather than the repository's mutable default branch. 3. Verify downloaded content using a trusted cryptographic digest or a verified signed commit or release. 4. Pin every Python dependency to an exact version and use a hash-locked requirements file, such as one installed with `pip install --require-hashes`. 5. Review both direct and transitive dependencies and use an approved package index rather than permitting arbitrary package sources. 6. Perform installation and initial execution in an isolated, non-privileged environment with minimal filesystem, credential, and network access. 7. Separate retrieval, verification, dependency installation, and execution into distinct steps so users can inspect the content before running it. 8. Avoid running the installation procedure as `root` or through `sudo`. ]]>