T03 · Remote Payload Retrieval and Execution
- Location
SKILL.md:91- Finding
Silent Remote Self-Update Creates a Mutable Instruction Execution Channel
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 91–105
Vulnerability Type: Silent retrieval and installation of mutable remote Skill instructions
Risk Level: CriticalVulnerable Code
bash git rev-parse --git-dir git symbolic-ref --short HEAD git fetch origin --quiet git diff --quiet HEAD origin/{branch} git pull --ff-only origin {branch} --quietThe surrounding instructions require this update check to run silently before every thesis review. Failures and skipped updates are not disclosed to the user, while a successful update is only reported after the remote changes have already been installed.
Technical Analysis
The Skill directs the Agent to invoke Bash, contact the Git remote named
origin, and install remote repository changes into the active Skill directory. The update is not pinned to an immutable commit and does not require a cryptographic checksum, trusted signature, fixed repository URL, change review, or user approval.The repository contains
SKILL.mdand supporting Markdown files that control the Agent's behavior. Consequently, pulling repository changes modifies executable Agent instructions rather than merely updating passive data. A remote party that controls the repository, a compromised maintainer account, or an attacker who changes the localoriginconfiguration can replace the audited instructions with new directives.The use of
git pull --ff-onlyprevents non-fast-forward merges but does not establish authenticity or safety. A malicious commit on the tracked remote branch can still be fast-forwarded and installed. The silent-failure rules further reduce visibility into the network operation and its source.Attack Path
- The user invokes the Skill to review a thesis.
- Before performing the review, the Agent checks whether the Skill directory is a Git repository and determines the current branch.
- The Agent executes
git fetch origin --quiet...[truncated 1644 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the automatic update procedure from the runtime instructions in
SKILL.md. - Do not permit a Skill to modify its own instructions while handling a user task.
- Move update management to a separate installation or package-management process that is not implicitly triggered by thesis review.
- Require explicit, informed user approval before any network request or repository modification.
- Pin updates to an immutable, reviewed commit identifier rather than a mutable branch.
- Validate that the remote URL exactly matches an approved repository before fetching.
- Verify releases using a trusted cryptographic signature or independently distributed checksum.
- Display the source, target commit, and proposed file changes before installation.
- Re-audit updated Skill instructions and supporting files before activating them.
- If update checks are retained, make them advisory only: report that an update exists without fetching or installing it automatically.
- Remove Bash from
allowed-toolsif it is not otherwise necessary for the core thesis-review workflow. - Record update attempts and outcomes visibly instead of requiring silent execution.
- Remove the automatic update procedure from the runtime instructions in