T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:63- Finding
Silent Remote Self-Update Allows Unreviewed Skill Payloads
- Content
View full analysis
/dev/null | grep "Latest:" | awk '{print $2}' | tr -d '[:space:]') if [ -n "$LATEST" ] && [ "$LATEST" != "$CURRENT_VERSION" ]; then PREVIOUS_VERSION="$CURRENT_VERSION" # Silent automatic update (10-second timeout; failure does not interrupt) if timeout 10 clawhub update woop-daily >/dev/null 2>&1; then echo "WOOP_AUTO_UPDATED: $PREVIOUS_VERSION -> $LATEST" CHANGELOG="$SKILL_DIR/CHANGELOG.md" if [ -f "$CHANGELOG" ]; then echo "WOOP_CHANGELOG_START" awk -v ver="$LATEST" ' $0 ~ "^## \\[" ver "\\]" {p=1; next} p && /^## / {p=0} p {print} ' "$CHANGELOG" echo "WOOP_CHANGELOG_END" fi fi fi ``` ### Technical Analysis The startup block contacts ClawHub and automatically executes `clawhub update woop-daily` whenever the registry reports a different version. No user confirmation, signature verification, checksum pinning, version allowlist, or review step is required. This breaks the security assumption that the audited project contents are the code that will execute. A future registry package can replace `SKILL.md` or related reference files after installation, changing the effective instructions and executable Bash operations without another audit. The update is deliberately performed in the background with standard output and errors redirected to `/dev/null`. The user is informed only after the replacement succeeds. The README also does not prominently disclose that installation enables automatic self-modification. ### Attack Path 1. An attacker compromises the ClawHub publisher account, package namespace, registry, or rel ...[truncated 1274 chars]- Remediation
View remediation