T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:43
- Finding
- Mutable Remote Repository Is Retrieved and Executed Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md`, lines 43–46 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash git clone https://github.com/openclaw-skills/ai-intelligent-live-chat cd ai-intelligent-live-chat pip install -r requirements.txt python app.py ``` ### Technical Analysis The installation instructions retrieve a mutable remote repository without pinning it to a reviewed commit, signed tag, or integrity hash. They then install dependencies from the repository's unseen `requirements.txt` and execute its unseen `app.py`. Consequently, the code ultimately executed can differ from the content present when this skill package was audited. The supplied artifact contains only documentation and metadata, so the remote application's source, dependency versions, package installation hooks, and runtime behavior cannot be verified locally. Dependency installation may itself execute package build or installation logic before `app.py` is launched. ### Attack Path 1. An attacker compromises the referenced repository, its maintainer account, or an upstream dependency. 2. The attacker adds a malicious dependency, installation hook, or application payload to the repository. 3. A user follows the documented `git clone` command, receiving the attacker's current repository content. 4. `pip install -r requirements.txt` installs the unverified dependencies and may execute malicious build or installation code. 5. `python app.py` executes the unverified application payload. 6. The payload operates with the permissions and environment access of the user who ran the commands. ### Impact Assessment Successful exploitation can result in arbitrary code execution under the invoking user's account. The effective scope can include reading or modifying files accessible to that account, accessing environment variables and locally available credentials, making network connections, and altering ...[truncated 405 chars]
- Remediation
- ## Remediation Suggestions - Include the complete, auditable implementation within the skill package rather than directing users to execute mutable remote content. - If remote retrieval is necessary, pin the repository to a specific reviewed commit and verify the downloaded content against a trusted cryptographic hash. - Use signed releases or signed commits and document the signature-verification procedure. - Pin every Python dependency to an exact version and use a lock file containing integrity hashes, such as a hash-locked requirements file. - Review dependencies for package-name confusion, compromised maintainers, unsafe source distributions, and installation hooks. - Separate retrieval, dependency installation, and execution into explicit steps so users can inspect the content before running it. - Execute the application in a least-privileged, isolated environment with restricted filesystem access, credentials, environment variables, and outbound network connectivity. - Ensure future releases place the reviewed source and dependency manifest under the same versioned artifact covered by the security audit.