T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:43
- Finding
- Unpinned Remote Payload Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 43-46 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash git clone https://github.com/openclaw-skills/ai-intelligent-feedback-collection cd ai-intelligent-feedback-collection pip install -r requirements.txt python app.py ``` ### Technical Analysis The documented installation procedure clones a mutable remote repository without pinning a reviewed commit, tag, or cryptographically verified release. It then installs dependencies from the remotely supplied `requirements.txt` and directly executes the remotely supplied `app.py`. Consequently, the effective payload is not contained in the audited Skill package and can change after this Skill has been reviewed. Neither the remote application nor its dependency manifest was present in the audited artifact, so their behavior, integrity, and dependency constraints could not be verified. HTTPS protects data in transit but does not ensure that the repository continues to contain the same code that was originally reviewed. A compromised repository owner account, malicious maintainer update, repository transfer, or compromised dependency could therefore introduce arbitrary executable code into this workflow. ### Attack Path 1. An attacker gains control of the referenced repository, contributes a malicious update that is accepted, or compromises a dependency selected by its `requirements.txt`. 2. The attacker adds malicious behavior to `app.py`, package installation hooks, or a dependency imported by the application. 3. A user follows the installation commands in `SKILL.md`. 4. `git clone` retrieves the attacker-controlled revision because no immutable commit is specified. 5. `pip install -r requirements.txt` may execute package build or installation logic supplied through the remote dependency chain. 6. `python app.py` directly executes the retrieved appli ...[truncated 845 chars]
- Remediation
- ## Remediation Suggestions 1. Include the reviewed application source and dependency lock files directly in the Skill package so the executable implementation is covered by the audit. 2. If remote retrieval is unavoidable, pin the repository to an immutable, reviewed commit hash rather than cloning the current default branch. 3. Distribute signed releases and verify the release signature or a trusted cryptographic checksum before installation or execution. 4. Pin every Python dependency and transitive dependency to an reviewed version using a lock file. 5. Require dependency hashes, such as with `pip install --require-hashes`, to prevent substitution of unexpected artifacts. 6. Audit dependency source names and indexes and use a controlled package registry where appropriate. 7. Avoid automatically executing the application immediately after retrieval. Provide a review and verification step before installation and startup. 8. Run the application as a dedicated, unprivileged account in a sandbox or container with narrowly scoped filesystem, credential, and network access. 9. Add release provenance and software bill of materials information so users can verify exactly which source revision and dependencies are being installed.