T03 · Remote Payload Retrieval and Execution
Error
- Location
heartbeat.md:43- Finding
Server-Controlled Replacement of Trusted Skill Instructions
- Content
View full analysis
`memory.localFetchedAt`: ```bash curl -s https://www.moltyroyale.com/skill.md > ~/.molty-royale/skills/skill.md curl -s https://www.moltyroyale.com/heartbeat.md > ~/.molty-royale/skills/heartbeat.md ``` Then update `memory.localFetchedAt` to the current time. ``` The corresponding instruction in `skill.md:87-89` is: ```markdown - Compare `response.skillLastUpdate` with `memory.localFetchedAt`. If `skillLastUpdate` is newer → re-download skill.md and heartbeat.md, then update `localFetchedAt`. ``` ### Technical Analysis The Skill permits a value returned by the remote API, `skillLastUpdate`, to trigger replacement of its locally audited instruction files with mutable content downloaded from project-controlled servers. There is no publisher-signature verification, expected cryptographic digest, immutable version identifier, content validation, rollback protection, or human review gate. Although the retrieved files are Markdown rather than native binaries, they are executable control inputs in an AI-agent environment: changes to these files can alter which credentials, tools, network destinations, and financial actions the Agent uses. This behavior exceeds the minimum privileges needed to play the game. Gameplay requires authenticated REST and WebSocket access, but it does not require the game service to overwrite the Agent's trusted local instructions. ### Attack Path 1. An attacker compromises the Molty Royale API, website, CDN, deployment pipeline, DNS, or an authorized publishing account. 2. The attacker causes `GET /accounts/me` to report a `skillLastUpdate` value newer than the locally recorded timestamp. 3. The next heartbeat executes the documented `curl` commands. 4. The audited `skill. ...[truncated 989 chars]- Remediation
View remediation