T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:41
- Finding
- Unpinned Remote Payload Retrieval and Dependency Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 41-46 **Vulnerability Type**: Mutable remote code retrieval followed by unsafe dependency installation and application execution **Risk Level**: High **Complete Code Snippet**: ```bash git clone https://github.com/openclaw-skills/ai-intelligent-demand-forecasting cd ai-intelligent-demand-forecasting pip install -r requirements.txt python app.py ``` ### Technical Analysis The installation instructions clone the default branch of an external Git repository without pinning a reviewed commit, immutable tag, checksum, or signed release. The effective code installed and executed can therefore change after this Skill has been audited. The instructions subsequently install packages from the remotely retrieved `requirements.txt`. Python packages may execute code during build or installation, and the document provides no dependency lockfile, package hashes, trusted-index restrictions, or version verification. Finally, the remotely retrieved `app.py` is executed directly. The audited package contains only `SKILL.md`; neither `requirements.txt` nor `app.py` is locally available for review. Consequently, the behavior of the downloaded dependencies and application cannot be established from this artifact. This represents both remote payload retrieval and an insecure software supply-chain boundary. ### Attack Path 1. An attacker compromises the referenced repository, its owner account, the default branch, or a dependency named in its `requirements.txt`. 2. The attacker modifies `app.py`, dependency declarations, or package installation behavior. 3. A user follows the documented installation commands, retrieving the current attacker-controlled repository state. 4. `pip install -r requirements.txt` may execute malicious package build or installation logic. 5. `python app.py` directly executes the downloaded payload. 6. The payload runs with the permissions and environm ...[truncated 721 chars]
- Remediation
- ## Remediation Suggestions 1. Package the reviewed implementation and dependency manifests directly with the Skill so that the installed code matches the audited artifact. 2. If remote retrieval is unavoidable, pin the repository to a specific reviewed commit hash rather than cloning a mutable default branch. 3. Distribute releases with cryptographic checksums or signatures and verify them before installation or execution. 4. Use a fully resolved dependency lockfile with exact versions and package hashes, such as hash-locked requirements installed with `pip --require-hashes`. 5. Restrict package retrieval to explicitly approved indexes and validate package names to reduce dependency-confusion and typosquatting risk. 6. Review both the application and all dependency installation paths before release. 7. Perform installation and execution in an isolated virtual environment or container using a non-privileged account, minimal filesystem access, no unnecessary secrets, and restricted network access. 8. Separate retrieval, verification, installation, and execution into distinct documented steps. Do not execute downloaded code unless integrity and provenance checks succeed.