T08 · Insecure Dependencies
Warning
- Location
HEARTBEAT.md:5- Finding
Unpinned Remote Replacement of Active Skill Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:15-21;HEARTBEAT.md:5-9
Vulnerability Type: Unverified remote skill installation and update
Risk Level: MediumVulnerable Code
SKILL.md:15-21:bash **Install locally:** ```bash mkdir -p ~/.moltbot/skills/moltguess curl -s https://moltguess.com/SKILL.md > ~/.moltbot/skills/moltguess/SKILL.md curl -s https://moltguess.com/HEARTBEAT.md > ~/.moltbot/skills/moltguess/HEARTBEAT.md curl -s https://moltguess.com/skill.json > ~/.moltbot/skills/moltguess/package.jsontext `HEARTBEAT.md:5-9`: ```bash ## First: Check for skill updates ```bash curl -s https://moltguess.com/skill.json | grep '"version"'If updated, re-fetch
SKILL.md.text ### Technical Analysis The installation procedure downloads mutable remote files directly into the active local skill directory. The recurring heartbeat also instructs the agent to detect a remotely declared version change and re-fetch `SKILL.md`. No immutable release identifier, cryptographic checksum, publisher signature, trusted manifest, or review gate is required before downloaded content replaces the installed instructions. HTTPS protects the connection in transit but does not protect against compromise of the publisher account, origin server, deployment pipeline, or another trusted component in the remote publishing path. This is especially relevant because the project contains no executable source code and its operative behavior is defined by Markdown instructions. Replacing `SKILL.md` or `HEARTBEAT.md` can therefore alter the actions an agent is instructed to perform after the package has already passed review. The use of `curl -s` also suppresses error messages and omits failure-safe options such as `--fail`, while direct shell redirection can truncate a valid local file before download success is established. ### Attack Path 1. An attacker compromises the `moltguess.com` publishing or ...[truncated 1502 chars]- Remediation
View remediation
Remediation Suggestions
- Publish immutable, versioned release artifacts rather than downloading mutable files from stable URLs.
- Maintain a trusted manifest containing the exact version and SHA-256 digest of every skill file. Pin the manifest or validate it with a publisher-controlled signing key.
- Verify cryptographic signatures and file digests before installing or activating any update. Reject unsigned, mismatched, expired, or downgraded releases.
- Download updates to a temporary file using failure-safe options, for example
curl --fail --show-error --location, and only atomically replace the active file after successful verification. - Preserve the last verified version if retrieval or validation fails. Do not redirect an unverified response directly over an active skill file.
- Require human review or an explicit approval gate when an update changes operational instructions, requested permissions, network destinations, commands, or credential handling.
- Display and audit the content diff before activation, and record the source version, digest, signature identity, and installation time.
- Restrict the agent runtime with least-privilege filesystem, network, tool, and credential access so that compromised instructions have limited impact.