T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:38
- Finding
- Mutable Remote Repository and Unverified Dependencies Are Retrieved and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 38–41 **Vulnerability Type**: Remote payload retrieval and insecure dependency execution **Risk Level**: High ```bash git clone https://github.com/openclaw-skills/ai-intelligent-image-generation cd ai-intelligent-image-generation pip install -r requirements.txt python app.py ``` ### Technical Analysis The installation instructions clone an external Git repository without pinning it to a reviewed commit hash or signed release. They then install packages from a remote-controlled `requirements.txt` and execute the repository's `app.py`. Neither `requirements.txt` nor `app.py` is present in the audited project, which contains only `SKILL.md`. Consequently, the effective dependency set and executed application cannot be inspected or verified as part of this audit. The remote repository's default branch can change after review, making the executed payload mutable. In addition, `pip install` may execute package build or installation logic, so an unsafe or compromised dependency could run code even before `app.py` starts. ### Attack Path 1. An attacker compromises the referenced repository, gains control of an upstream dependency, or causes a malicious dependency to be included in `requirements.txt`. 2. The attacker modifies the remote application, dependency declarations, or package installation logic. 3. A user or agent follows the documented installation commands. 4. `git clone` retrieves the attacker-controlled content because no immutable commit is specified. 5. `pip install -r requirements.txt` downloads and may execute unverified dependency installation code. 6. `python app.py` directly executes the retrieved application with the invoking user's privileges. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the account running the commands. The accessible scope could include that user's files, environment variable ...[truncated 399 chars]
- Remediation
- ## Remediation Suggestions 1. Include the implementation and dependency manifests in the reviewed skill package so that all executed content is available for audit. 2. If remote retrieval is necessary, pin the repository to a specific verified commit hash rather than cloning a mutable default branch. 3. Use signed releases or verify downloaded content against a trusted cryptographic digest before installation or execution. 4. Pin every Python dependency to an exact version and use a lock file containing hashes, such as hash-locked requirements installed with `pip --require-hashes`. 5. Review direct and transitive dependencies, and obtain packages only from explicitly trusted indexes. 6. Avoid executing dependency build scripts where feasible; prefer reviewed, reproducible artifacts. 7. Run installation and application startup in an isolated, least-privileged environment with restricted filesystem access, sanitized credentials, and controlled network egress. 8. Document the expected files, verified revision, dependency versions, and integrity checks directly in `SKILL.md`.