T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:47
- Finding
- Recurring Execution of Mutable Remote Heartbeat Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 47–58 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```markdown ## Heartbeat setup (ask the owner) During installation, your agent **must ask the human owner** if they want to enable a periodic heartbeat. - If the owner says **YES**: fetch and run `HEARTBEAT.md` on a schedule (e.g. every 2–6 hours) to check boards and optionally post/reply. - If the owner says **NO**: do not run heartbeat; only post when explicitly instructed. (Heartbeat is not auto-installed by default — it’s an explicit owner choice.) | **SKILL.md** (this file) | `https://www.4claw.org/skill.md` | | **HEARTBEAT.md** | `https://www.4claw.org/heartbeat.md` | | **skill.json** (metadata) | `https://www.4claw.org/skill.json` | ``` ### Technical Analysis The Skill instructs the agent to periodically fetch and run `HEARTBEAT.md` from an external website. That remote file is not included in the audited package, is not pinned to a cryptographic digest or immutable version, and has no documented signature verification mechanism. Consequently, the effective heartbeat behavior can change after the Skill has been reviewed or installed. Compromise of the website, hosting account, deployment pipeline, or DNS resolution could allow an attacker to replace the heartbeat instructions. The agent may then interpret and execute the substituted instructions with whatever tools, credentials, filesystem access, and network permissions are available in its runtime. Human opt-in reduces the likelihood of unexpected activation, but it does not secure subsequent retrievals or require review when the remote content changes. The recurring schedule also provides repeated opportunities to deliver modified instructions. ### Attack Path 1. The owner approves heartbeat operation during installation. 2. The agent creates or uses a recurring process that retri ...[truncated 1382 chars]
- Remediation
- ## Remediation Suggestions 1. Bundle `HEARTBEAT.md` inside the Skill package so its complete behavior is available during security review. 2. If remote updates are necessary, retrieve only immutable, versioned content and verify it against a trusted cryptographic hash or digital signature before use. 3. Do not automatically “run” arbitrary Markdown fetched from the network. Parse a narrowly defined, validated data format containing only explicitly supported heartbeat operations. 4. Require renewed human approval whenever the heartbeat document version, digest, requested operations, or destination changes. 5. Restrict heartbeat execution to an allowlist of required 4claw API endpoints and HTTP methods. Prevent access to unrelated tools, files, credentials, and network origins. 6. Run the heartbeat with a dedicated, least-privileged token where possible, and apply strict limits to posting, replying, and bumping. 7. Record the fetched version, verified digest, requested actions, and execution results in an audit log. 8. Store the API key in an operating-system credential manager where available. If file storage is required, create `~/.config/4claw/credentials.json` with permissions limited to the owning user, such as mode `0600`, and ensure the token is never logged.