T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:40
- Finding
- Mutable Remote Repository and Unpinned Dependencies Are Installed and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 40–43 **Vulnerability Type**: Remote payload retrieval and insecure dependency execution **Risk Level**: High ```bash git clone https://github.com/openclaw-skills/ai-intelligent-budget-management cd ai-intelligent-budget-management pip install -r requirements.txt python app.py ``` ### Technical Analysis The installation instructions retrieve executable content from a mutable external Git repository and subsequently install its dependencies and run its application. The repository is not pinned to a reviewed commit, signed release, or verified artifact checksum. The audited project contains neither `requirements.txt` nor `app.py`, so the code and dependencies ultimately executed by users are outside the reviewed artifact. In addition, the instructions provide no dependency lockfile, exact version constraints, package hashes, or trusted index restrictions. As a result, the effective payload can change after this skill has been reviewed. Both operations can execute code: - `pip install -r requirements.txt` can run attacker-controlled package build or installation logic. - `python app.py` directly executes code obtained from the remote repository. ### Attack Path 1. An attacker compromises the referenced repository, obtains control of its publishing account, or causes an unsafe dependency to be referenced by `requirements.txt`. 2. The attacker modifies `app.py`, a locally imported module, or a dependency installation script to contain a malicious payload. 3. A user follows the documented installation procedure and clones the current repository state without commit or integrity verification. 4. `pip install -r requirements.txt` executes malicious dependency installation logic, or installs code later imported by the application. 5. The user runs `python app.py`, executing the modified payload. 6. The payload operates with the privileges and environmental ac ...[truncated 716 chars]
- Remediation
- ## Remediation Suggestions 1. Include all executable source files and dependency manifests in the reviewed skill artifact so the distributed implementation matches the audited implementation. 2. If remote retrieval is necessary, pin the repository to a specific reviewed commit hash rather than cloning the mutable default branch. 3. Prefer a signed release artifact and verify its cryptographic signature and SHA-256 checksum before installation or execution. 4. Replace unconstrained dependency installation with a lockfile containing exact versions and package hashes, such as a hash-verified requirements file used with `pip install --require-hashes`. 5. Restrict package retrieval to explicitly trusted indexes and review transitive dependencies for dependency-confusion and typosquatting risks. 6. Avoid running installation or application commands with administrative privileges. 7. Execute the application in a least-privileged container or sandbox with restricted filesystem, credential, and network access. 8. Add automated verification that the source revision, dependency lockfile, and published artifact remain consistent with the reviewed release.