T03 · Remote Payload Retrieval and Execution
- Location
scripts/clawpet.sh:4- Finding
Execution of Unpinned Code from a Mutable Remote Repository
- Content
View full analysis
Vulnerability Details
File Location:
scripts/clawpet.sh, lines 4-15; corroborating dependency declaration inSKILL.md, lines 8-12 and 98-101
Vulnerability Type: Remote payload retrieval and execution through an unpinned Git dependency
Risk Level: MediumVulnerable Code
bash REPO_URL="git+https://github.com/yazelin/clawpet.git" if command -v clawpet >/dev/null 2>&1; then exec clawpet "$@" fi if command -v uvx >/dev/null 2>&1; then exec uvx --from "$REPO_URL" clawpet "$@" fi if command -v uv >/dev/null 2>&1; then exec uv tool run --from "$REPO_URL" clawpet "$@" fiThe corresponding installation metadata also uses the mutable repository reference:
yaml install: - id: clawpet-git kind: pip package: "git+https://github.com/yazelin/clawpet.git" bins: [clawpet] label: "Install clawpet from GitHub"Technical Analysis
The wrapper retrieves and executes a Python package directly from a GitHub repository without pinning it to an immutable commit hash, verified release artifact, or integrity digest. When a local
clawpetexecutable is unavailable,uvxoruv tool runresolves the repository's current state and runs itsclawpetentry point.Because the dependency reference does not identify a fixed revision, the effective executable payload can change after this skill has been reviewed. A compromise of the upstream repository, malicious maintainer update, repository ownership transfer, or unauthorized modification could therefore turn an ordinary pet-management command into arbitrary code execution.
This is best classified as remote payload retrieval and execution because runtime behavior explicitly fetches executable code from an external, mutable source.
Attack Path
- An attacker compromises the referenced GitHub repository or otherwise gains the ability to publish malicious code to its default ...[truncated 1443 chars]
- Remediation
View remediation
Remediation Suggestions
-
Pin the Git dependency to a reviewed immutable commit:
bash REPO_URL="git+https://github.com/yazelin/clawpet.git@<full-reviewed-commit-sha>"Apply the same immutable reference in
SKILL.md. -
Prefer a trusted, versioned package release with cryptographic hash verification rather than executing directly from a repository branch.
-
Avoid runtime dependency retrieval. Require administrators to install an approved version in advance, then verify the local executable's version before invoking it.
-
For stronger assurance, vendor the minimal required implementation into the audited package and review all transitive dependencies.
-
Use lock files and integrity hashes for the complete dependency graph. Re-audit and deliberately update the pinned revision when upstream changes are required.
-
Run the command in a restricted environment with minimal filesystem, credential, and network access so that a compromised dependency cannot access unrelated agent resources.
-