T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:29
- Finding
- Unpinned Remote Skill Instructions Are Retrieved and Followed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29–43 and 70–84 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```markdown ## Setup **No setup required.** This skill uses GitHub raw URLs as the primary method to fetch sub-skill documentation. Sub-skill SKILL.md files are loaded directly from GitHub: \`\`\` https://raw.githubusercontent.com/muratcankoylan/Agent-Skills-for-Context-Engineering/main/skills/<sub-skill>/SKILL.md \`\`\` Example: For `context-optimization`, use: \`\`\` https://raw.githubusercontent.com/muratcankoylan/Agent-Skills-for-Context-Engineering/main/skills/context-optimization/SKILL.md \`\`\` ``` ```markdown ## How to Load a Sub-Skill 1. Identify the best-matching row above. 2. Check if the local sub-skill SKILL.md exists: \`\`\` references/context-engineering-skills/skills/<sub-skill>/SKILL.md \`\`\` - **If the file exists locally:** Read it directly. - **If the file does NOT exist** (e.g., submodule not initialized): Fetch from GitHub: \`\`\` https://raw.githubusercontent.com/muratcankoylan/Agent-Skills-for-Context-Engineering/main/skills/<sub-skill>/SKILL.md \`\`\` 3. Follow the instructions in that file. Most sub-skills have a `references/` directory with detailed patterns — read those files only when the relevant pattern is needed (progressive disclosure). 4. If the user's task spans two sub-skills (e.g., memory + multi-agent), read both SKILL.md files before responding. ``` ### Technical Analysis The Skill instructs the agent to retrieve external `SKILL.md` content from the mutable `main` branch of a third-party GitHub repository and then explicitly directs the agent to follow the retrieved instructions. The remote content is neither bundled with the audited package nor pinned to an immutable commit. No cryptographic digest, signature verification, content allowlist, or trust-boundary restriction is specified ...[truncated 2667 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor all required sub-skill files into the package and review them as part of the same release. 2. If remote retrieval is necessary, pin URLs to a specific reviewed Git commit instead of the mutable `main` branch. 3. Bundle an allowlist of expected files and cryptographic SHA-256 digests, and reject content that fails verification. 4. Treat remote content as untrusted reference material rather than authoritative instructions. Do not direct the agent to automatically “follow the instructions” in fetched files. 5. Parse and expose only the narrowly required informational sections instead of loading arbitrary remote content into the instruction hierarchy. 6. Require explicit user approval before retrieving or applying updated remote material. 7. Apply least privilege to the hosting agent: disable shell, sensitive-file, persistent-memory, and unrestricted network access unless required for the user's task. 8. Define a controlled update process in which upstream changes are reviewed, integrity metadata is updated, and a new local Skill version is released. 9. For offline submodule use, pin the submodule to a reviewed commit and prevent automatic updates to an unreviewed branch tip. ]]>