T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:24
- Finding
- Mutable Quantitative-Trading Repository and Dependencies Are Retrieved and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:24-28` and `SKILL-ZH.md:24-28` **Vulnerability Type**: Remote payload retrieval and insecure dependency installation **Risk Level**: High ### Vulnerable Code ```bash # Clone repository git clone https://github.com/ZhenRobotics/openclaw-quant.git ~/openclaw-quant cd ~/openclaw-quant # Install dependencies pip install -r requirements.txt ``` The Chinese version contains the equivalent commands: ```bash # 克隆仓库 git clone https://github.com/ZhenRobotics/openclaw-quant.git ~/openclaw-quant cd ~/openclaw-quant # 安装依赖 pip install -r requirements.txt ``` ### Technical Analysis The Skill instructs users or agents to clone the current state of a remote Git repository and immediately install its Python dependencies. It does not specify an immutable commit hash or verified release, validate a signed tag, check a cryptographic digest, or require dependency hashes. The effective code executed by the Skill is therefore not contained in the audited package and can change after this review. In addition, `pip install -r requirements.txt` may execute package build logic from dependencies selected by the externally maintained requirements file. This creates two related risks: 1. The cloned repository can be changed or compromised after publication of the Skill. 2. Its requirements can resolve to compromised, substituted, or otherwise unsafe packages. The project documentation later loads Binance API credentials from environment variables for live trading: ```python api_key=os.getenv('BINANCE_API_KEY'), api_secret=os.getenv('BINANCE_API_SECRET') ``` No evidence in the reviewed files proves that these credentials are exfiltrated. However, externally retrieved code executed in the same user environment could potentially read them. ### Attack Path 1. An attacker compromises the referenced repository, a maintainer account, a dependency, or an upstream package release. 2. The attacker modifies the default bran ...[truncated 1358 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the repository to an audited immutable commit: ```bash git clone https://github.com/ZhenRobotics/openclaw-quant.git ~/openclaw-quant cd ~/openclaw-quant git checkout --detach <audited-commit-sha> ``` 2. Publish and verify signed release tags. 3. Provide an expected commit identifier and cryptographic checksum through a trusted channel. 4. Lock every Python dependency, including transitive dependencies, to reviewed versions. 5. Generate a hash-locked requirements file and install with: ```bash pip install --require-hashes -r requirements.lock ``` 6. Install into a dedicated virtual environment rather than the user's global Python environment. 7. Perform installation before exposing exchange credentials to the process. 8. Use exchange API keys restricted to required symbols and trading operations, with withdrawals disabled. 9. Default to testnet or paper trading; require explicit confirmation before enabling live trading. 10. Include the executable implementation in the audited artifact, or independently audit the exact pinned external release. ]]>