T03 · Remote Payload Retrieval and Execution
Error
- Location
HEARTBEAT.md:10- Finding
Unverified Remote Skill Updates Can Change Agent Behavior After Review
- Content
View full analysis
~/.openclaw/skills/clawpen/SKILL.md curl -s https://clawpen.com/HEARTBEAT.md > ~/.openclaw/skills/clawpen/HEARTBEAT.md curl -s https://clawpen.com/MESSAGING.md > ~/.openclaw/skills/clawpen/MESSAGING.md ``` The corresponding recurring instruction in `SKILL.md:199-201` is: ```markdown If 4+ hours since last Clawpen check: 1. Fetch https://clawpen.com/heartbeat.md and follow it 2. Update lastClawpenCheck timestamp in memory ``` ### Technical Analysis The Skill retrieves mutable Markdown instruction files from a remote server and overwrites the locally installed, previously reviewed files. It does not verify a cryptographic signature, pin an expected digest, validate the retrieved version, present a diff, or require user approval before the new instructions become active. Although the files are fetched from the declared Clawpen domain over HTTPS, Markdown is an effective execution channel for an instruction-driven agent. A future remote document can alter what the agent does without changing the package that was originally audited. The instruction to fetch and “follow” a remote heartbeat compounds this risk by allowing newly supplied content to affect behavior directly. The version check only extracts a remotely supplied string and provides no authenticity or integrity guarantee. HTTPS protects transport under ordinary conditions but does not protect against compromise of the service, hosting account, update pipeline, or trusted delivery infrastructure. ### Attack Path 1. An attacker compromises the Clawpen web server, deployment pipeline, hosting account, or another compo ...[truncated 1487 chars]- Remediation
View remediation