T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:43
- Finding
- Execution of Mutable, Unreviewed Remote Code and Dependencies## Vulnerability Details **File Location**: `SKILL.md`, lines 43–46 **Vulnerability Type**: Remote payload retrieval and insecure dependency installation **Risk Level**: High ```bash git clone https://github.com/openclaw-skills/ai-intelligent-behavior-analysis cd ai-intelligent-behavior-analysis pip install -r requirements.txt python app.py ``` ### Technical Analysis The installation instructions retrieve source code from an external GitHub repository and execute it locally. The repository is cloned without selecting a verified commit, signed release, or immutable content digest. Consequently, its effective payload can change after this Skill has been reviewed. The supplied artifact contains neither `app.py` nor `requirements.txt`, so their contents could not be audited. The `pip install -r requirements.txt` command also installs an externally controlled dependency set without any visible version lock, package hash validation, or signature verification. Python package installation may execute package build or installation logic, while the subsequent `python app.py` command directly executes the retrieved application. This creates both a remote-payload risk and a software supply-chain risk. The artifact does not itself demonstrate malicious code, but its documented installation process crosses the review boundary and executes mutable, unverified content. ### Attack Path 1. An attacker compromises the referenced GitHub repository, a maintainer account, its default branch, or a dependency referenced by its requirements file. 2. The attacker modifies `app.py`, `requirements.txt`, or a transitive dependency to include malicious code. 3. A user follows the documented instructions and clones the current repository state. 4. `pip install -r requirements.txt` installs attacker-controlled packages and may execute malicious package installation or build logic. 5. `python app.py` directly runs the retrieved application code. 6. ...[truncated 1015 chars]
- Remediation
- ## Remediation Suggestions 1. Include the complete, reviewable implementation and dependency manifests in the Skill package rather than requiring execution of a separate mutable repository. 2. If external retrieval is unavoidable, pin the repository to a specific reviewed commit hash instead of the default branch. 3. Distribute code through a signed release and verify its cryptographic signature or published checksum before installation or execution. 4. Replace the unconstrained requirements file with a lock file containing exact dependency versions and cryptographic hashes. Install with hash enforcement, such as `pip install --require-hashes`. 5. Review direct and transitive dependencies for dependency confusion, typosquatting, known vulnerabilities, and unexpected installation hooks. 6. Perform installation and execution in an isolated virtual environment or restricted container using a dedicated unprivileged account. 7. Restrict filesystem mounts, environment variables, credentials, devices, and outbound network access to the minimum required for behavior analysis. 8. Document the expected files, verified commit identifier, dependency versions, required permissions, and integrity-verification procedure. 9. Add automated checks that reject changed release artifacts, unlocked dependencies, and unsigned or unverified source revisions.