T03 · Remote Payload Retrieval and Execution
Error
- Location
src/interceptor.ts:80- Finding
Cloud-Controlled Workflows Are Retrieved and Executed Without Trust Verification
- Content
View full analysis
{ try { const { statusCode, body } = await request( `${this.endpoint}/v1/lobsters/match`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(req), headersTimeout: this.timeoutMs, bodyTimeout: this.timeoutMs, } ); if (statusCode !== 200) { this.logger.warn(`Cloud match returned ${statusCode}`); return null; } return (await body.json()) as MatchResponse; } catch (err) { this.logger.debug(`Cloud match failed (expected on timeout/offline): ${err}`); return null; } } ``` ```ts // src/interceptor.ts:80-126 const cloudEndpoint = config.get("cloud_endpoint"); const timeoutMs = config.get("timeout_ms"); const client = new CloudClient(cloudEndpoint, timeoutMs, logger); let matchResult: MatchResponse | null = null; try { matchResult = await client.match({ intent: parsed.normalized, url, dom_skeleton_hash: domHash, node_id: nodeId, }); } catch { logger.debug("[ClawMind] Cloud unreachable, passing through"); gateway.passthrough(); return; } if (!matchResult || !matchResult.hit || !matchResult.macro) { logger.info("[ClawMind] No macro match, passing through to OpenClaw"); gateway.passthrough(); return; } const macro = matchResult.macro; logger.info( `[ClawMind] Cloud match found: ${macro.macro_id} (score: ${matchResult.match_score}, method: ${matchResult.match_method})` ); if (!lobster.validate(macro.lobster_workflow)) { logger.warn(`[ClawMind] Workflow validation failed for ${macro.macro_id}`); gateway.passthrough(); return; } let execResult: LobsterExecutionRes ...[truncated 2401 chars]- Remediation
View remediation