T03 · Remote Payload Retrieval and Execution
Error
- Location
- references/notifications.md:111
- Finding
- Mutable Remote Watcher Is Downloaded and Persistently Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `references/notifications.md:111-123` **Vulnerability Type**: Remote payload retrieval followed by scheduled execution **Risk Level**: High ### Vulnerable Code ```bash The watcher script polls `/api/notifications/pending` every minute via crontab. Zero LLM tokens when idle — it only wakes your agent (via OpenClaw hook) when events exist. **Download:** curl -sf https://agenticstreet.ai/api/watcher.sh -o ~/.openclaw/skills/agentic-street/ast-watcher.sh chmod +x ~/.openclaw/skills/agentic-street/ast-watcher.sh **Install in crontab:** * * * * * AST_API_KEY=your_key OPENCLAW_HOOK_TOKEN=your_token ~/.openclaw/skills/agentic-street/ast-watcher.sh >> /tmp/ast-watcher.log 2>&1 ``` The remote download is also documented at `references/api-reference.md:1007-1013`: ```bash ### GET /api/watcher.sh Download the automated watcher script (no auth required). curl -sf https://agenticstreet.ai/api/watcher.sh -o ast-watcher.sh ``` ### Technical Analysis The installation instructions retrieve an executable shell script from a mutable service endpoint, make it executable, and instruct the user to run it every minute through cron. The downloaded artifact is not tied to a release version, repository commit, checksum, signature, or other immutable identity. The bundled `scripts/ast-watcher.sh` was inspected and did not contain an embedded malicious payload. The vulnerability is that the code ultimately installed by a user may differ from the audited bundled script. A later compromise of the service, DNS or hosting infrastructure, deployment pipeline, or maintainer account could replace the remote watcher with arbitrary shell code. Because cron repeatedly invokes the downloaded file, a one-time compromise of the download endpoint can establish recurring execution under the installing user's account. The cron process also supplies sensitive credentials to the script, increasing the consequences of payload substitution. # ...[truncated 1489 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Install the bundled, reviewed `scripts/ast-watcher.sh` rather than downloading an independently mutable copy at installation time. 2. If remote distribution is required, publish immutable versioned release URLs and a SHA-256 checksum or cryptographic signature. 3. Verify the checksum or signature before applying executable permissions or creating a scheduled task. 4. Ensure the downloaded version corresponds exactly to the source revision reviewed in the Skill package. 5. Do not automatically update the watcher from the network. Require an explicit, reviewable upgrade action. 6. Document how to remove the cron entry, revoke watcher credentials, and verify the installed script. 7. Run the watcher as an unprivileged dedicated account with minimal filesystem and network access. 8. Prefer a user-level service with sandboxing controls and a restricted environment over a system-wide crontab. ]]>