T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:40
- Finding
- Unpinned Remote Payload Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 40–43 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash git clone https://github.com/openclaw-skills/ai-intelligent-employee-onboarding cd ai-intelligent-employee-onboarding pip install -r requirements.txt python app.py ``` ### Technical Analysis The installation instructions retrieve a mutable external Git repository without pinning it to a reviewed commit or immutable release. They subsequently install dependencies from the retrieved `requirements.txt` and execute the retrieved `app.py`. The remote source code and dependency manifest are not included in the audited artifact, which contains only `SKILL.md` and `skill.json`. Consequently, the effective payload cannot be verified during this audit and may change after publication or review. Both Python package installation hooks and `app.py` can execute arbitrary code with the privileges of the user following these instructions. Package provenance is also unclear because `skill.json` identifies the author as `yang1002378395-cmyk`, while `SKILL.md` attributes the project to “OpenClaw Skills Team.” This discrepancy does not independently prove malicious behavior, but it limits confidence in the external repository's ownership. ### Attack Path 1. An attacker compromises the referenced repository, gains control of its publishing account, or otherwise causes malicious content to be added to its default branch. 2. The attacker modifies `app.py`, `requirements.txt`, or a referenced dependency to include an arbitrary payload. 3. A user follows the documented installation procedure and clones the current default branch without an immutable revision pin. 4. `pip install -r requirements.txt` may execute malicious package installation or build hooks. 5. `python app.py` directly executes the remotely controlled application payload. 6. The payload operates with the invoking user ...[truncated 687 chars]
- Remediation
- ## Remediation Suggestions 1. Include the complete, auditable application source and dependency manifests directly in the Skill package. 2. If external retrieval is unavoidable, pin the repository to a reviewed full commit SHA rather than cloning a mutable default branch. 3. Verify downloaded content using cryptographic hashes or signed releases before installation or execution. 4. Pin every Python dependency to an exact reviewed version and require package hashes, such as through `pip install --require-hashes`. 5. Generate and review a software bill of materials and use automated dependency vulnerability scanning. 6. Publish verifiable repository ownership and reconcile the author discrepancy between `skill.json` and `SKILL.md`. 7. Execute installation and startup in a least-privileged, isolated environment without unnecessary credentials, sensitive mounts, or host access. 8. Replace direct execution instructions with a reproducible build process based on immutable, reviewed artifacts.