T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:43
- Finding
- Mutable Remote Repository Is Retrieved and Executed Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md`, lines 43–46 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash git clone https://github.com/openclaw-skills/ai-intelligent-employee-survey cd ai-intelligent-employee-survey pip install -r requirements.txt python app.py ``` ### Technical Analysis The installation instructions clone a mutable external Git repository without selecting or verifying an immutable commit, signed tag, release artifact, or cryptographic checksum. They then install dependencies declared by the remotely retrieved repository and directly execute its `app.py`. Consequently, the code executed by users is not contained in the audited project and can change after this skill has been reviewed. If the repository, its maintainer account, or its dependency configuration is compromised, the installation procedure can execute attacker-controlled Python package installation logic or application code. The artifact contains no local implementation or dependency manifest with which to validate the advertised employee-survey privacy and anonymity properties. ### Attack Path 1. An attacker compromises the external repository, a maintainer account, or a dependency referenced by its remotely supplied `requirements.txt`. 2. The attacker modifies `app.py`, the dependency manifest, or package installation logic to include a malicious payload. 3. A user follows the documented installation procedure and clones the current repository state. 4. `pip install -r requirements.txt` runs package installation behavior, or `python app.py` directly executes the altered application. 5. The payload executes with the privileges and environmental access of the user running the commands. 6. Depending on that user's access, the payload could read or modify local files, access credentials available to the process, communicate over the network, or access employee sur ...[truncated 503 chars]
- Remediation
- ## Remediation Suggestions - Include the reviewed application source and dependency manifest in the skill package instead of relying entirely on a mutable external repository. - If remote retrieval is necessary, check out a specific audited commit hash rather than the repository's default branch. - Verify a signed release or cryptographic checksum before installing or executing retrieved content. - Pin every Python dependency to an exact version and trusted package index. - Use a hash-locked dependency file and install with `pip install --require-hashes`. - Review dependencies for malicious installation hooks, dependency confusion, and known vulnerabilities. - Run the application as a dedicated, unprivileged account inside an isolated virtual environment or container. - Restrict filesystem and network access to the minimum required for survey operation. - Document and implement controls for survey-data storage, anonymization, encryption, retention, access authorization, and outbound transmission. - Avoid instructing users to execute newly retrieved code until its provenance and integrity have been verified.