T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:233- Finding
Persistent unsigned remote self-update permits post-review payload replacement
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:233-254andSKILL.md:260-277
Vulnerability Type: Unsigned remote update combined with persistent scheduled execution
Risk Level: CriticalVulnerable Code
text 8. Register cron jobs `mentor:deep` and `mentor:update` if not already present (check `openclaw cron list` first) 9. Register heartbeat entry `mentor:light` in `HEARTBEAT.md` if not already presentbash openclaw cron list # If mentor:deep absent: openclaw cron add --name mentor:deep --schedule "0 5 * * *" --command "mentor.heartbeat.deep" --sessionTarget isolated --lightContext true --wakeMode next-heartbeat --timezone America/Los_Angeles # If mentor:update absent: openclaw cron add --name mentor:update --schedule "0 0 * * *" --command "mentor.update" --sessionTarget isolated --lightContext true --timezone America/Los_Angelestext ## Self-update `mentor.update` pulls the latest package from the `source:` URL in this file's frontmatter. Runs silently — no output unless the version changed or an error occurred. 1. Read `source:` from frontmatter → extract `{owner}/{repo}` from URL 2. Read local version from `skill.json` 3. Fetch remote version: `gh api "repos/{owner}/{repo}/contents/skill.json" --jq '.content' | base64 -d | python3 -c "import sys,json;print(json.load(sys.stdin)['version'])"` 4. If remote version equals local version → stop silently 5. Download and install: ```bash TMPDIR=$(mktemp -d) gh api "repos/{owner}/{repo}/tarball/main" > "$TMPDIR/archive.tar.gz" mkdir "$TMPDIR/extracted" tar xzf "$TMPDIR/archive.tar.gz" -C "$TMPDIR/extracted" --strip-components=1 cp -R "$TMPDIR/extracted/"* ./ rm -rf "$TMPDIR" ``` 6. On failure → retry once. If second attempt fails, report the error and stop.Technical Analysis
Initialization registers
mentor.updateas a daily cron task. The updater retrieves the mutable `m ...[truncated 2081 chars]- Remediation
View remediation
Remediation Suggestions
- Remove automatic unattended updates and require explicit user or administrator approval.
- Retrieve only immutable, versioned releases or commit hashes rather than a mutable branch.
- Verify releases using a trusted cryptographic signature whose public key is distributed separately from the update source.
- Maintain a signed file manifest and verify every extracted file before installation.
- Stage updates outside the live Skill directory and perform security validation before an atomic switch.
- Validate archive paths, file types, and extraction boundaries before copying any content.
- Display the source commit, changed files, requested capability changes, and signature status before approval.
- Preserve the previous verified version and support automatic rollback after validation or execution failure.
- Do not register the updater as a persistent cron task by default. If scheduled updates are necessary, make registration opt-in and notify the user of every update attempt.