T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:42
- Finding
- Unpinned Remote Payload Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 42–47 **Vulnerability Type**: Remote, mutable code is retrieved and executed without integrity verification **Risk Level**: High ```bash git clone https://github.com/openclaw-skills/ai-intelligent-content-generation cd ai-intelligent-content-generation pip install -r requirements.txt python app.py ``` ### Technical Analysis The installation instructions clone a remote Git repository without pinning a commit, tag, or cryptographically verified release. They then install dependencies from the remotely supplied `requirements.txt` and execute the remotely supplied `app.py`. Because neither the referenced implementation nor its dependency manifest is included in the audited artifact, their behavior cannot be verified. The effective payload may change after this Skill has been reviewed. If the repository, its maintainer account, or an upstream dependency is compromised, following these instructions could execute attacker-controlled code. The `pip install` step can itself execute code through package build and installation hooks. The subsequent `python app.py` command directly executes the cloned application. This creates two execution points for unverified remote content. ### Attack Path 1. An attacker compromises the referenced repository, a maintainer account, or a dependency selected by its unpinned dependency manifest. 2. The attacker modifies `requirements.txt`, a dependency package, `app.py`, or another imported module to contain a malicious payload. 3. A user follows the installation instructions after the remote content has changed. 4. `git clone` retrieves the attacker-controlled content without checking it against an audited commit or expected digest. 5. `pip install -r requirements.txt` may execute malicious package installation hooks. 6. `python app.py` executes the downloaded application under the user's account. 7. The payload can act with the i ...[truncated 803 chars]
- Remediation
- ## Remediation Suggestions - Include the complete implementation and dependency metadata in the reviewed Skill package so that executable behavior is available during security review. - Pin the source repository to a specific audited commit hash rather than cloning its mutable default branch. - Distribute signed releases and verify the release signature and cryptographic digest before installation or execution. - Pin every Python dependency to an exact reviewed version and use a lockfile containing hashes, such as hashes generated and enforced through `pip --require-hashes`. - Review direct and transitive dependencies for dependency confusion, typosquatting, known vulnerabilities, and unexpected build hooks. - Prefer prebuilt, provenance-verified artifacts and disable unnecessary source builds during dependency installation. - Run installation and execution as a dedicated, unprivileged user inside an isolated virtual environment, container, or sandbox. - Restrict filesystem, credential, and network access to only what the application requires. - Add explicit verification steps to the documentation and fail closed if a commit, signature, or dependency hash does not match the reviewed value.