T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:23
- Finding
- Unpinned Remote Repository Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md:23-37` **Vulnerability Type**: Unpinned external code retrieval followed by dependency installation and shell-script execution **Risk Level**: High ```bash # Clone to standard location git clone https://github.com/ZhenRobotics/openclaw-investor-relations-manager.git ~/openclaw-investor-relations-manager cd ~/openclaw-investor-relations-manager # Install dependencies npm install # Configure API key echo 'OPENAI_API_KEY="sk-your-key-here"' > .env ``` ### Step 3: Verify Installation ```bash cd ~/openclaw-investor-relations-manager ./agents/ir-cli.sh help ``` ### Technical Analysis The installation procedure clones the mutable default branch of an external GitHub repository without pinning a reviewed commit or verifying a signature or checksum. It then runs `npm install`, which may execute package lifecycle scripts, and directly executes a downloaded shell script. The executable repository contents and dependency tree are not included in the audited artifact. Their behavior can therefore change after this Skill has been reviewed. This creates a remote payload execution channel: control of the upstream repository, its maintainer account, or a dependency can alter the code that future users download and execute. The API key is subsequently stored in the downloaded project's `.env` file. Any malicious installation hook or project script executing in that directory could attempt to read this credential along with accessible financial data and local files. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or a dependency resolved by `npm install`. 2. The attacker adds malicious code to the default branch, a dependency lifecycle hook, or `agents/ir-cli.sh`. 3. A user follows the documented installation procedure and clones the mutable repository state. 4. `npm install` executes attacker-controlled lifecycle code, or t ...[truncated 816 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the external repository to a specific reviewed commit hash rather than relying on its mutable default branch. 2. Publish and verify a cryptographic checksum or signed release before executing any downloaded content. 3. Include the complete executable source in the Skill package so that the reviewed artifact matches the executed implementation. 4. Commit a dependency lockfile and replace `npm install` with `npm ci` to enforce exact dependency versions. 5. Review package lifecycle scripts and use `npm ci --ignore-scripts` where installation scripts are not required. 6. Audit `agents/ir-cli.sh` and all transitive dependencies before recommending execution. 7. Run the application in a sandbox or container with restricted filesystem and network access. 8. Use a narrowly scoped, revocable API key and avoid exposing it to installation hooks or unrelated processes. 9. Document which financial data is transmitted to external services and require explicit user approval before transmission.