T03 · Remote Payload Retrieval and Execution
Warning
- Location
- SKILL.md:39
- Finding
- Unpinned Remote Repository Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 39-42 **Vulnerability Type**: Unreviewed remote payload retrieval and dependency installation **Risk Level**: Medium ```bash git clone https://github.com/openclaw-skills/ai-intelligent-expense-management cd ai-intelligent-expense-management pip install -r requirements.txt python app.py ``` ### Technical Analysis The artifact does not contain the advertised application source code or its dependency manifest. Instead, its installation instructions direct users to clone a mutable remote repository, install dependencies from an unreviewed `requirements.txt`, and execute `app.py`. No commit hash, release archive checksum, signature, or dependency hashes are specified. Consequently, the code executed by users may differ from the content that existed when this skill was audited. The unavailable dependency manifest also prevents verification of dependency names, versions, package sources, and transitive dependencies. This creates both a remote payload risk and a software supply-chain risk. The instructions themselves do not automatically execute code; exploitation requires a user or agent to follow them. ### Attack Path 1. An attacker compromises the referenced repository, its maintainer account, the selected default branch, or a dependency referenced by its `requirements.txt`. 2. The attacker adds malicious installation behavior, application code, or a malicious dependency release. 3. A user or agent follows the documented commands and clones the current repository state without pinning it to a reviewed commit. 4. `pip install -r requirements.txt` may execute package build or installation logic supplied by an attacker-controlled dependency. 5. `python app.py` directly executes the downloaded application with the privileges and environment access of the invoking user. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the invoking user's privileges. Depending ...[truncated 556 chars]
- Remediation
- ## Remediation Suggestions 1. Include the complete executable source and dependency manifest in the reviewed skill package. 2. If remote retrieval remains necessary, pin the repository to a specific reviewed commit rather than a mutable branch. 3. Publish and verify a cryptographic checksum or trusted signature for the retrieved source. 4. Pin every direct and transitive Python dependency to an reviewed version and require hashes, such as through a lock file and `pip install --require-hashes`. 5. Use only trusted package indexes and explicitly configure allowed dependency sources to reduce dependency-confusion risk. 6. Review dependency installation scripts and the application entry point before execution. 7. Install and run the application in an isolated virtual environment or sandbox under a dedicated, least-privileged account. 8. Restrict access to sensitive files, environment variables, credentials, and unnecessary network destinations during installation and execution.