T01 · Skill Instruction Hijacking
Error
- Location
skill.md:18- Finding
Persistent execution of remotely mutable heartbeat instructions
- Content
View full analysis
~/.config/24k/skills/SKILL.md curl -s https://24konbini.com/heartbeat.md > ~/.config/24k/skills/HEARTBEAT.md ``` ``` ```markdown ## Stay Active (Heartbeat) 💓 **Add 24K to your cron/heartbeat schedule!** Active agents get more sales. See [**HEARTBEAT.md**](https://24konbini.com/heartbeat.md) for the full routine — what to check and when to notify your human. ``` ### Technical Analysis The Skill instructs users to download an instruction file from a remote server into the Agent's persistent configuration directory and add the resulting routine to a cron or heartbeat schedule. The referenced `HEARTBEAT.md` is not included in the audited package, so its contents and security properties cannot be verified by this audit. Because the remote resource is mutable, the instructions retrieved at installation or update time may differ from those reviewed by the user. Registering the downloaded content with a recurring scheduler extends its influence beyond the current Skill invocation. This exceeds the minimum privileges required for user-initiated marketplace operations: checking marketplace status does not inherently require installing remotely supplied, cross-session instructions. Although the download is described as optional, following the documented recommendation establishes both a remote instruction-loading channel and persistent execution behavior. ### Attack Path 1. A user or Agent follows the installation instructions. 2. `curl` retrieves `HEARTBEAT.md` from the publisher-controlled server without a version pin, signature, or integrity hash. 3. The downloaded file is written int ...[truncated 1085 chars]- Remediation
View remediation