T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/gateway-guardian.sh:263- Finding
Persistent watchdog automatically downloads and executes a mutable remote script
- Content
View full analysis
> "$LOG_FILE" 2>&1 || nuclear_rc=$? if [[ "$nuclear_rc" -ne 0 ]]; then log "Step 4: Nuclear reinstall script exited with code $nuclear_rc." return 1 fi ``` The recovery chain invokes it automatically: ```bash restart_all_steps() { do_graceful_restart && return 0 do_hard_restart && return 0 do_kickstart && return 0 do_nuclear_reinstall && return 0 ``` ```bash case "$ERROR_CLASS" in billing) handle_billing_exhaustion ;; transient|timeout|unknown) log "ESCALATING: Error class '$ERROR_CLASS' — restarting may help." restart_all_steps exit $? ;; esac ``` ### Technical Analysis The persistent guardian retrieves the current contents of `https://clawd.bot/install.sh` and sends them directly to Bash. The effective code is not part of the reviewed package and can change at any time. No version pin, checksum, digital signature, or local inspection step protects this execution. This is more dangerous than a documented one-line installer because the operation can occur without contemporaneous user approval. The guardian classifies unknown or transient provider failures as recoverable and eventually reaches the remote reinstall after local recovery mechanisms fail. ### Attack Path 1. The guardian runs periodically through its persistent service. 2. An attacker or outag ...[truncated 830 chars]- Remediation
View remediation