T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:94
- Finding
- Unverified Remote Skill Payload Retrieval and Activation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 94-127 and 190-198 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```markdown curl "https://clawdtm.com/api/v1/skills/install?slug=SKILL_SLUG" ``` ```markdown **To install:** Write each file from the `files` array into `./skills/{slug}/` in the current workspace. If `files` is `null`, the skill files could not be fetched from GitHub. Fall back to `clawhub install {slug}` instead. ``` ```markdown 4. Fetch: `GET https://clawdtm.com/api/v1/skills/install?slug={chosen}` 5. Check security risk -- follow the security policy above 6. Write files from `files` array to `./skills/{slug}/` 7. Tell your human to restart their agent session to activate the new skill ``` ### Technical Analysis The documented workflow retrieves executable scripts and agent instruction files from a mutable external API, writes them into the active skills directory, and directs the user to restart the agent to activate them. The payload returned by the service can therefore change after this skill has been reviewed. The workflow relies on security scores and flags supplied by the same external service that supplies the files. It does not require a signed manifest, a pinned cryptographic digest, immutable release identifiers, an independent local security review, or explicit approval of the exact downloaded contents. The fallback to `clawhub install` likewise delegates installation to an external package source without defining equivalent integrity controls. Although this file does not itself contain an embedded malicious script, compromise or malicious operation of the remote service could turn the skill into a remote payload delivery channel. ### Attack Path 1. An attacker compromises the remote API, its storage, its delivery infrastructure, or an upstream skill source. 2. The attacker causes the install endpoint to return malicious `SKILL.md` instructions ...[truncated 1315 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Permit installation only from allowlisted, immutable releases. 2. Require a signed manifest covering every file path, file digest, skill identity, and version. 3. Verify signatures and pinned cryptographic hashes locally before writing any content. 4. Independently scan and review every returned file rather than relying exclusively on server-provided scores. 5. Display the complete file list, hashes, requested changes, and security findings before requesting explicit installation approval. 6. Download files into a quarantined staging directory and do not automatically activate them. 7. Require separate, explicit approval before moving reviewed files into the active skills directory. 8. Remove the unverified `clawhub install` fallback or apply the same provenance, integrity, and review requirements to it. 9. Use least-privilege execution and sandbox installed skills by restricting filesystem, network, credential, and command access. 10. Pin the trusted service identity and maintain an auditable installation record containing the source, version, signer, and verified hashes. ]]>