T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:41
- Finding
- Unpinned Remote Payload Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 41-44 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash git clone https://github.com/openclaw-skills/ai-intelligent-helpdesk cd ai-intelligent-helpdesk pip install -r requirements.txt python app.py ``` ### Technical Analysis The installation procedure retrieves the current default branch of a remote Git repository without pinning it to a reviewed commit hash or verifying its integrity. It subsequently installs packages from a remotely supplied `requirements.txt` file and executes the remotely supplied `app.py`. Neither `requirements.txt` nor `app.py` is present in the audited package, so their behavior cannot be inspected or verified as part of this audit. The effective executable payload can change after the Skill has been reviewed because the remote repository is mutable. Although GitHub is a legitimate hosting service, it does not establish the trustworthiness or immutability of repository content. This creates a supply-chain execution channel: compromise of the repository, its maintainer account, or its dependencies could cause future users to install or execute attacker-controlled code. ### Attack Path 1. An attacker compromises the referenced repository or a maintainer account, or otherwise gains the ability to alter its default branch. 2. The attacker modifies `app.py`, `requirements.txt`, or a dependency installation hook to contain malicious code. 3. A user follows the documented installation instructions. 4. `git clone` downloads the modified content without checking a trusted commit or signature. 5. `pip install -r requirements.txt` may execute malicious package build or installation code. 6. `python app.py` directly executes the downloaded application with the privileges of the installing user. ### Impact Assessment Successful exploitation can provide arbitrary code execution under the installin ...[truncated 585 chars]
- Remediation
- ## Remediation Suggestions 1. Include the complete executable source and dependency manifest in the Skill package so that the reviewed artifact is the artifact users execute. 2. If remote retrieval is necessary, check out an explicitly reviewed commit hash rather than the mutable default branch. 3. Publish signed releases and verify the release signature or a trusted cryptographic checksum before installation or execution. 4. Pin every Python dependency to an exact version and use a hash-locked requirements file, such as one installed with `pip --require-hashes`. 5. Review direct and transitive dependencies for malicious packages, typosquatting, known vulnerabilities, and unsafe build hooks. 6. Install dependencies inside an isolated virtual environment or container using a non-privileged account. 7. Avoid running installation or application commands as root, and restrict filesystem, credential, and network access to the minimum required. 8. Add automated integrity and provenance checks to ensure that the downloaded source exactly matches the version that passed security review.