T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:41
- Finding
- Mutable Remote Repository and Unpinned Dependencies Are Installed and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 41-44 **Vulnerability Type**: Remote payload retrieval and insecure software supply chain **Risk Level**: High ### Vulnerable Code ```bash git clone https://github.com/openclaw-skills/ai-intelligent-knowledge-base cd ai-intelligent-knowledge-base pip install -r requirements.txt python app.py ``` ### Technical Analysis The packaged skill does not contain the advertised application implementation. Instead, its installation instructions retrieve the application from an external Git repository and execute it without pinning the repository to a reviewed commit or verifying its integrity. The subsequent `pip install -r requirements.txt` command also installs dependencies defined by the remotely retrieved repository. No dependency lock file, package hashes, signatures, or version constraints are available in the audited artifact. Consequently, neither the application code nor its transitive dependencies can be verified from this package. Because the repository's default branch and dependency sources are mutable, the effective payload can change after this skill has been reviewed. A repository compromise, maintainer account compromise, malicious update, dependency confusion attack, or compromised upstream package could introduce attacker-controlled code. ### Attack Path 1. An attacker compromises the referenced repository, a maintainer account, or one of the packages named in its remotely supplied `requirements.txt`. 2. The attacker adds malicious installation behavior, a malicious Python dependency, or malicious code to `app.py`. 3. A user follows the documented installation procedure and clones the current default branch without selecting a trusted commit. 4. `pip install -r requirements.txt` may execute attacker-controlled package build or installation logic. 5. The user runs `python app.py`, directly executing the remotely supplied payload. 6. The payload ...[truncated 712 chars]
- Remediation
- ## Remediation Suggestions 1. Include the complete, reviewable application source code in the skill package rather than retrieving executable code at installation time. 2. If external retrieval is unavoidable, pin the Git checkout to a specific reviewed commit hash rather than relying on a mutable default branch. 3. Verify the downloaded source using a trusted cryptographic signature or an independently distributed checksum before installation or execution. 4. Commit a dependency lock file containing exact versions and cryptographic hashes. Install dependencies using hash verification, such as `pip install --require-hashes`. 5. Review and constrain transitive dependencies, and obtain packages only from explicitly configured trusted indexes. 6. Run installation and application processes under a dedicated, least-privileged account in an isolated environment or container without unnecessary secrets, host mounts, or network access. 7. Perform security review and malware scanning on the pinned application source and every dependency before publishing the skill.