T03 · Remote Payload Retrieval and Execution
Warning
- Location
- scripts/clawpet.sh:4
- Finding
- Execution of Unpinned Code from a Mutable Remote Repository## Vulnerability Details **File Location**: `scripts/clawpet.sh`, lines 4-15; corroborating dependency declaration in `SKILL.md`, lines 8-12 and 98-101 **Vulnerability Type**: Remote payload retrieval and execution through an unpinned Git dependency **Risk Level**: Medium ### Vulnerable Code ```bash REPO_URL="git+https://github.com/yazelin/clawpet.git" if command -v clawpet >/dev/null 2>&1; then exec clawpet "$@" fi if command -v uvx >/dev/null 2>&1; then exec uvx --from "$REPO_URL" clawpet "$@" fi if command -v uv >/dev/null 2>&1; then exec uv tool run --from "$REPO_URL" clawpet "$@" fi ``` The corresponding installation metadata also uses the mutable repository reference: ```yaml install: - id: clawpet-git kind: pip package: "git+https://github.com/yazelin/clawpet.git" bins: [clawpet] label: "Install clawpet from GitHub" ``` ### Technical Analysis The wrapper retrieves and executes a Python package directly from a GitHub repository without pinning it to an immutable commit hash, verified release artifact, or integrity digest. When a local `clawpet` executable is unavailable, `uvx` or `uv tool run` resolves the repository's current state and runs its `clawpet` entry point. Because the dependency reference does not identify a fixed revision, the effective executable payload can change after this skill has been reviewed. A compromise of the upstream repository, malicious maintainer update, repository ownership transfer, or unauthorized modification could therefore turn an ordinary pet-management command into arbitrary code execution. This is best classified as remote payload retrieval and execution because runtime behavior explicitly fetches executable code from an external, mutable source. ### Attack Path 1. An attacker compromises the referenced GitHub repository or otherwise gains the ability to publish malicious code to its default ...[truncated 1443 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the Git dependency to a reviewed immutable commit: ```bash REPO_URL="git+https://github.com/yazelin/clawpet.git@<full-reviewed-commit-sha>" ``` Apply the same immutable reference in `SKILL.md`. 2. Prefer a trusted, versioned package release with cryptographic hash verification rather than executing directly from a repository branch. 3. Avoid runtime dependency retrieval. Require administrators to install an approved version in advance, then verify the local executable's version before invoking it. 4. For stronger assurance, vendor the minimal required implementation into the audited package and review all transitive dependencies. 5. Use lock files and integrity hashes for the complete dependency graph. Re-audit and deliberately update the pinned revision when upstream changes are required. 6. Run the command in a restricted environment with minimal filesystem, credential, and network access so that a compromised dependency cannot access unrelated agent resources.