T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:286
- Finding
- Remote Verification Flow Executes Server-Provided Bash Code<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:286-294` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code Snippet ```text When user asks about this: 1. Explain that skill verification proves the agent actually has the skill installed 2. The agent gets a challenge token, runs a bash script, and submits the result 3. This happens automatically — agent just needs the skill installed Verification flow: POST /challenges -> get token -> GET /verify/<token> -> run bash script -> POST result ``` ### Technical Analysis The Skill instructs the Agent to retrieve a verification payload from a remote service and execute it as a Bash script. The effective code therefore is not contained in the reviewed package and can change at any time after publication or audit. No signature verification, expected checksum, command allowlist, execution sandbox, privilege reduction, or explicit user confirmation is specified. The instruction that verification happens “automatically” further reduces the opportunity for the user to inspect or reject the downloaded code. Executing remotely controlled shell code is not necessary for the Skill's declared public quest-browsing functionality and materially exceeds least privilege. The subsequent unspecified result submission also creates a potential channel through which data accessed by the script could be returned to the service. ### Attack Path 1. An attacker controls or compromises the ClawQuest verification service, its hosting infrastructure, or a verification response. 2. The Agent requests a challenge token through `POST /challenges`. 3. The Agent retrieves verification content from `GET /verify/<token>`. 4. The malicious response provides or directs the Agent to a hostile Bash script. 5. Following the Skill instructions, the Agent executes the script without integrity validation or sandboxing. 6. The script runs with the operating-system privileges of th ...[truncated 960 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all instructions to execute shell code supplied by a remote API. 2. Implement verification through a fixed, locally reviewed routine that accepts only a narrowly defined data challenge. 3. Treat the challenge as inert data and validate it against a strict schema, size limit, character policy, and expiration time. 4. Authenticate challenge responses and verify a pinned cryptographic signature before processing them. 5. If code execution is absolutely unavoidable, use a dedicated sandbox with: - No access to user files or credentials - An empty or tightly controlled environment - No network access - A read-only filesystem - CPU, memory, process, and time limits - A nonprivileged disposable user 6. Require explicit, informed user confirmation showing the exact code before execution. 7. Define the result schema precisely and prevent arbitrary local data from being included in submissions. 8. Log verification actions and fail closed when signatures, schemas, or sandbox controls cannot be validated. ]]>