T03 · Remote Payload Retrieval and Execution
Warning
- Location
- SKILL.md:40
- Finding
- Unpinned Remote Payload Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 40-43 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Medium ```bash git clone https://github.com/openclaw-skills/ai-intelligent-customer-segmentation cd ai-intelligent-customer-segmentation pip install -r requirements.txt python app.py ``` ### Technical Analysis The installation instructions direct users to clone a mutable remote Git repository, install the dependencies declared by that repository, and execute its application. The repository is not pinned to a reviewed commit, release tag, or cryptographically verified artifact. Consequently, the code ultimately executed may differ from what existed when this skill file was audited. The project artifact contains only `SKILL.md`; neither `app.py` nor `requirements.txt` is available locally for review. The behavior of the downloaded application and its installation dependencies therefore cannot be verified from the audited artifact. In addition, Python package installation may execute package build or installation logic, extending the risk beyond the explicitly invoked `app.py`. ### Attack Path 1. An attacker compromises the referenced repository, gains control of its organization or maintainer account, or otherwise causes malicious content to appear on its default branch. 2. The attacker modifies `app.py`, `requirements.txt`, or a referenced package so that malicious code is executed during installation or application startup. 3. A user follows the documented commands without pinning or independently reviewing the retrieved revision. 4. `pip install -r requirements.txt` executes dependency installation behavior, and `python app.py` directly executes the downloaded application. 5. The payload runs with the privileges and environmental access of the user executing the commands. ### Impact Assessment Successful exploitation could permit arbitrary code execution under the invok ...[truncated 556 chars]
- Remediation
- ## Remediation Suggestions - Include the complete implementation and dependency manifest in the skill package so they can be audited together. - Pin the Git checkout to a specific reviewed commit hash rather than relying on the mutable default branch. - Publish signed release artifacts and verify their signatures or cryptographic checksums before installation. - Lock every Python dependency and transitive dependency to an exact reviewed version. - Require package hashes during installation, such as through a hash-locked requirements file and `pip --require-hashes`. - Review dependencies for malicious installation hooks, dependency confusion, and typosquatting before distribution. - Execute the application in a dedicated, least-privileged virtual environment or container with restricted filesystem, credential, and network access. - Separate retrieval, verification, dependency installation, and execution into explicit steps so users can inspect the exact payload before running it.