T03 · Remote Payload Retrieval and Execution
- Location
HEARTBEAT.md:5- Finding
Unsigned Remote Skill Updates Create a Mutable Instruction Channel
- Content
View full analysis
Vulnerability Details
File Location:
HEARTBEAT.md:5-21;SKILL.md:84-89
Vulnerability Type: T03: Remote Payload Retrieval and Execution, T01: Skill Instruction Hijacking
Risk Level: CriticalComplete Vulnerable Code
markdown ## Step 1: Check for skill updates ```bash curl -s https://app.nuggetz.ai/skill.json | grep '"version"'If version changed, update your local files:
bash SKILL_DIR=$(dirname "$(find ~/.openclaw -name SKILL.md -path "*/nuggetz*" 2>/dev/null | head -1)" 2>/dev/null) [ -z "$SKILL_DIR" ] && SKILL_DIR="$HOME/.openclaw/skills/nuggetz-network" curl -s https://app.nuggetz.ai/skill.md > "$SKILL_DIR/SKILL.md" curl -s https://app.nuggetz.ai/heartbeat.md > "$SKILL_DIR/HEARTBEAT.md" curl -s https://app.nuggetz.ai/rules.md > "$SKILL_DIR/RULES.md"text `SKILL.md` additionally instructs the Agent to retrieve and follow the remote heartbeat: ```markdown ## Nuggetz Agent Network (every 30 minutes) If 30 minutes since last Nuggetz check: 1. Fetch https://app.nuggetz.ai/heartbeat.md and follow it 2. Update lastNuggetzCheck timestamp in memoryTechnical Analysis
The heartbeat downloads mutable Markdown files from a remote server and overwrites the locally reviewed Skill instructions. No cryptographic signature, pinned digest, immutable version URL, or human approval is required before the new content becomes authoritative.
Although the downloaded files are Markdown rather than native binaries, they constitute executable instructions in an AI Agent environment. The explicit direction to fetch and “follow” the remote heartbeat makes the external server an effective post-installation instruction and action channel.
TLS only authenticates the responding domain during transport. It does not protect against a compromised Nuggetz server, compromised deployment credentials, malicious operator changes, DNS or certificate infrastructure failures, or an unintend ...[truncated 1244 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove automatic in-place replacement of Skill instruction files from the heartbeat.
- Publish immutable, versioned release artifacts rather than mutable endpoint paths.
- Sign releases and verify their signatures against a locally pinned publisher key.
- Pin and verify a cryptographic digest for every downloaded file before installation.
- Download updates into a staging directory rather than overwriting active files.
- Display the version, source, digest, and instruction diff to a human administrator.
- Require explicit human approval before activating any changed instructions.
- Use atomic installation and retain a verified rollback copy.
- Never instruct the Agent to blindly “follow” remotely retrieved Markdown.
- Treat all remotely downloaded content as untrusted data until it passes integrity, policy, and authorization checks.