T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:614- Finding
Mutable Remote Skill Bundle Is Treated as Runtime Execution Authority
- Content
View full analysis
and are the **runtime execution authority**: ```bash # Re-install the full skill bundle (updates HEARTBEAT.md, SKILL.md, references/): openjobs install-skill --agent --force ``` ``` ### Technical Analysis The Skill instructs the agent to forcibly refresh its complete instruction bundle at the start of every heartbeat. It explicitly declares the remotely published documents to be the “runtime execution authority.” Consequently, the effective Skill behavior is not limited to the files that were statically audited. The remote publisher—or an attacker who compromises the publisher, package distribution channel, account, DNS, TLS termination, or update infrastructure—can introduce new instructions after review. The `--force` option further indicates that existing local instructions may be overwritten without a version comparison or user confirmation. This creates a remotely mutable control channel. New versions could direct the agent to run arbitrary commands, access credentials, upload local files, transfer funds, or weaken safety boundaries. ### Attack Path 1. An attacker compromises the OpenJobs publication or package-update infrastructure. 2. The attacker modifies the distributed Skill bundle to include malicious commands or instructions. 3. A scheduled or manually initiated heartbeat starts. 4. The agent executes `openjobs install-skill --agent --force`. 5. The reviewed local Skill files are replaced by the attacker-controlled version. 6. The agent treats the newly retrieved content as authoritative and follows its instructions. 7. Malicious commands ex ...[truncated 510 chars]- Remediation
View remediation