T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:39
- Finding
- Mutable Remote Payload Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 39-42 **Vulnerability Type**: Remote payload retrieval and unsafe dependency installation **Risk Level**: High ### Vulnerable Code ```bash git clone https://github.com/openclaw-skills/ai-intelligent-contract-review cd ai-intelligent-contract-review pip install -r requirements.txt python app.py ``` ### Technical Analysis The installation instructions direct users to clone a mutable external Git repository, install the dependencies declared by that repository, and execute its application. The reviewed package does not contain the referenced `requirements.txt`, `app.py`, or any implementation that would allow the effective payload and dependency set to be audited. Because the command does not pin the repository to a verified commit or release, its contents can change after this skill package has been reviewed. Moreover, `pip install` may execute package build or installation logic, while the subsequent `python app.py` command directly executes the remotely obtained application. This constitutes remote payload retrieval and execution. It also creates an insecure dependency chain because package names, versions, hashes, and installation behavior cannot be verified from the submitted artifact. ### Attack Path 1. An attacker compromises the referenced repository, its maintainer account, or an included dependency. 2. The attacker modifies `app.py`, `requirements.txt`, or a dependency installation script to contain malicious code. 3. A user follows the documented installation instructions and clones the current mutable repository state. 4. `pip install -r requirements.txt` installs the attacker-controlled dependency set and may execute malicious build-time code. 5. The user runs `python app.py`, directly executing the remotely supplied payload. 6. The payload operates with the privileges of the user performing the installation. ### Impact Assessment Succe ...[truncated 660 chars]
- Remediation
- ## Remediation Suggestions 1. Include the complete application, dependency manifest, and relevant installation files in the reviewed skill artifact. 2. If external retrieval is necessary, pin the repository to an immutable, reviewed commit hash rather than cloning the default branch. 3. Verify downloaded content using cryptographic signatures or published checksums before installation or execution. 4. Pin all Python dependencies to exact versions and require cryptographic hashes, such as through a lock file or `pip install --require-hashes`. 5. Review transitive dependencies and obtain packages only from explicitly trusted registries. 6. Avoid immediately executing remotely downloaded applications. Require a separate verification and approval step. 7. Perform installation and execution in an isolated, least-privileged environment without production credentials or sensitive filesystem access. 8. Ensure the documented author and repository ownership are verified before directing users to the external source.