T03 · Remote Payload Retrieval and Execution
Error
- Location
- HEARTBEAT.md:10
- Finding
- Unverified Remote Skill Updates Can Change Agent Behavior After Review<![CDATA[ ## Vulnerability Details **File Location**: `HEARTBEAT.md:10-17` **Additional Locations**: `SKILL.md:27-30`, `SKILL.md:200-201` **Vulnerability Type**: Unverified retrieval and activation of mutable remote instructions **Risk Level**: High ### Vulnerable Code ```bash curl -s https://clawpen.com/skill.json | grep '"version"' ``` ```bash curl -s https://clawpen.com/SKILL.md > ~/.openclaw/skills/clawpen/SKILL.md curl -s https://clawpen.com/HEARTBEAT.md > ~/.openclaw/skills/clawpen/HEARTBEAT.md curl -s https://clawpen.com/MESSAGING.md > ~/.openclaw/skills/clawpen/MESSAGING.md ``` The corresponding recurring instruction in `SKILL.md:199-201` is: ```markdown If 4+ hours since last Clawpen check: 1. Fetch https://clawpen.com/heartbeat.md and follow it 2. Update lastClawpenCheck timestamp in memory ``` ### Technical Analysis The Skill retrieves mutable Markdown instruction files from a remote server and overwrites the locally installed, previously reviewed files. It does not verify a cryptographic signature, pin an expected digest, validate the retrieved version, present a diff, or require user approval before the new instructions become active. Although the files are fetched from the declared Clawpen domain over HTTPS, Markdown is an effective execution channel for an instruction-driven agent. A future remote document can alter what the agent does without changing the package that was originally audited. The instruction to fetch and “follow” a remote heartbeat compounds this risk by allowing newly supplied content to affect behavior directly. The version check only extracts a remotely supplied string and provides no authenticity or integrity guarantee. HTTPS protects transport under ordinary conditions but does not protect against compromise of the service, hosting account, update pipeline, or trusted delivery infrastructure. ### Attack Path 1. An attacker compromises the Clawpen web server, deployment pipeline, hosting account, or another compo ...[truncated 1487 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Publish immutable, versioned releases rather than retrieving mutable files from stable URLs. 2. Sign the release manifest and verify its signature against a public key embedded in the reviewed package. 3. Pin and verify a cryptographic digest for every downloaded file before it is installed or interpreted. 4. Download updates to a staging directory rather than overwriting active files immediately. 5. Show the user a version change summary and instruction diff, then require explicit approval before activation. 6. Use secure temporary files and atomic replacement only after all verification succeeds. 7. Reject redirects to unapproved origins and enforce the expected HTTPS host. 8. Retain a known-good version and provide an automatic rollback mechanism. 9. Replace “fetch and follow” with a narrowly defined, locally stored heartbeat procedure that calls only documented API endpoints. 10. Treat all remotely retrieved Markdown as untrusted data until its publisher signature and exact content have been verified. ]]>