T03 · Remote Payload Retrieval and Execution
Warning
- Location
- SKILL.md:32
- Finding
- Mutable Remote Skill Instructions Cross the Local Audit Boundary<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:32-42` **Vulnerability Type**: Mutable remote instruction retrieval **Risk Level**: Medium ### Vulnerable Code ```markdown ```bash curl -s https://ethskills.com/ship/SKILL.md ``` Need a specific topic? Fetch only what's relevant: ```bash curl -s https://ethskills.com/gas/SKILL.md # Gas & real costs curl -s https://ethskills.com/security/SKILL.md # Security patterns curl -s https://ethskills.com/standards/SKILL.md # ERC-20, ERC-721, etc. ``` ``` ### Technical Analysis The skill instructs an AI agent to retrieve additional `SKILL.md` documents from a mutable external website and consume them as operational guidance. These remote documents are not included in the audited package and are not pinned to an immutable version, cryptographic digest, or reviewed commit. HTTPS provides transport confidentiality and server authentication but does not guarantee that the content will remain unchanged after this audit. If the website, DNS configuration, hosting account, deployment pipeline, or authorized publisher is compromised, the retrieved documents could contain attacker-controlled instructions. Because the documents are presented as skill guidance, an agent may treat them as trusted instructions and execute commands or disclose information requested by them. The reviewed local files do not pipe the downloaded content directly into a shell and do not themselves transmit credentials, private keys, environment variables, or user data. Therefore, this is a mutable remote-instruction and supply-chain risk rather than confirmed sensitive-data exfiltration or direct native-code execution. ### Attack Path 1. An attacker compromises `ethskills.com`, its hosting infrastructure, deployment credentials, DNS, or an authorized content-maintainer account. 2. The attacker modifies a referenced remote `SKILL.md`, such as `ship/SKILL.md`, while leaving the audited local package unchanged. 3. An agent act ...[truncated 1156 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor reviewed topic documents into the skill package so the audited content is immutable for a given release. 2. If remote retrieval is necessary, reference an immutable version or commit and verify each response against a pinned SHA-256 digest before use. 3. Treat downloaded documents as untrusted reference material rather than higher-priority agent instructions. 4. Explicitly state that remote content cannot override system instructions, user intent, safety constraints, or data-handling policies. 5. Require explicit user approval before executing any command or accessing, transmitting, or modifying data based on remotely retrieved guidance. 6. Restrict outbound requests to an allowlist and run suggested commands in a sandbox with minimal filesystem and network access. 7. Publish signed releases or signed content manifests and fail closed when signature or integrity verification fails. 8. Display retrieval failures rather than using silent `curl -s` behavior; use options such as `--fail --show-error` alongside integrity validation. ]]>