T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:16- Finding
Unverified Mutable Executable Download and Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Hiveram
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent coordination purpose, but its install path asks users to run an unverified mutable binary installer and it syncs persistent agent context with limited scoping guidance.
Review before installing. Prefer a pinned Workledger release with published checksum or signature verification, install to a user-owned bin directory when possible, avoid storing secrets or customer data in shared context, keep the API key narrowly scoped and rotated, and treat delete/context-put operations as changes to shared multi-agent state.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The skill requires obtaining and storing a long-lived API key, then exporting it into the environment for use by the tool. While expected for an authenticated service, this increases credential exposure risk because environment variables can leak through process inspection, logs, crash reports, shell history, or agent/tool context if mishandled.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
The install instructions fetch release metadata from GitHub and pipe a downloaded archive directly into
tarfor installation, without checksum or signature verification. This creates a supply-chain risk: if the release endpoint, transport path, or upstream account is compromised, an operator may install a malicious binary into/usr/local/bin.- Content
bash # Linux amd64 curl -sL https://github.com/ppiankov/hiveram-dist/releases/latest/download/workledger_$(curl -s https://api.github.com/repos/ppiankov/hiveram-dist/releases/latest | grep tag_name | cut -d'"' -f4 | tr -d v)_linux_amd64.tar.gz | tar xz -C /usr/local/bin workledger # macOS (Apple Silicon) curl -sL https://github.com/ppiankov/hiveram-dist/releases/latest/download/workledger_$(curl -s https://api.github.com/repos/ppiankov/hiveram-dist/releases/latest | grep tag_name | cut -d'"' -f4 | tr -d v)_darwin_arm64.tar.gz | tar xz -C /usr/local/bin workledger
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
The macOS install example has the same unsafe pattern as the Linux one: dynamic version lookup from GitHub API followed by direct extraction of a remote archive. Because the binary is installed from unverified remote content, the skill encourages execution of third-party code with inadequate integrity checks.
- Content
curl -sL https://github.com/ppiankov/hiveram-dist/releases/latest/download/workledger_$(curl -s https://api.github.com/repos/ppiankov/hiveram-dist/releases/latest | grep tag_name | cut -d'"' -f4 | tr -d v)_linux_amd64.tar.gz | tar xz -C /usr/local/bin workledger
macOS (Apple Silicon)
curl -sL https://github.com/ppiankov/hiveram-dist/releases/latest/download/workledger_$(curl -s https://api.github.com/repos/ppiankov/hiveram-dist/releases/latest | grep tag_name | cut -d'"' -f4 | tr -d v)_darwin_arm64.tar.gz | tar xz -C /usr/local/bin workledger
text Verify: `workledger version` (expect 0.7.7+)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Single line, just the key echo "wl_sk_your_key_here" > ~/.openclaw/workledger.key chmod 600 ~/.openclaw/workledger.key- Export env vars (add to shell profile or systemd unit):
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
The skill is explicitly designed for cross-session and cross-machine persistence of shared work orders, notes, history, and context. In an agent environment, this can cause sensitive project data, prompts, operational context, or secrets to be retained and propagated beyond the current session, especially because the skill promotes central synchronization and handoff between agents.
- Content
Work Orders
bash workledger create <project> --title "Deploy new service" --priority P1 --tags "infra,k8s" workledger list <project> --status open workledger list --all # cross-project workledger get <project> <id>
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The markdown lists
workledger delete <project> <id>as a core command, but there is no nearby warning that this operation removes a work order and may be irreversible or affect shared multi-agent state. For markdown files, destructive behaviors that could affect user data or system integrity should be disclosed clearly.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## Security - API key stored in file with `chmod 600`, not in env files or git - pastewatch v0.24.1+ detects `wl_sk_` keys as critical severity - Key file path: `~/.openclaw/workledger.key` (inside pastewatch protectedPaths)
Static analysis
No suspicious patterns detected.