T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:29
- Finding
- Mutable Remote Documentation Used as an Executable Code Source## Vulnerability Details **File Location**: `SKILL.md`, lines 29–68 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Relevant snippet**: ```markdown ## Authoritative tool-doc source (required) The published Markdown files under `https://sciminer.tech/tool_api_files/` are the single source of truth for `provider_name`, `tool_name`, allowed `parameters`, file-upload behavior, request encoding, and the example submission flow for this skill's included tools. Use these SciMiner Markdown docs: - `AlphaExtractor` -> `AlphaExtractor_api_doc.md` The agent MUST: 1. Resolve the selected tool's Markdown file and read it before every invocation. 2. Never invent `provider_name`, `tool_name`, parameter names, enum values, upload-field names, content type, or submission flow from memory. 3. Extract and follow the selected doc section's exact: - Base URL - API endpoint - Content-Type - Authentication header - Tool Name - Method - Parameter table, including required fields and enum values - File-upload instructions and example code 4. Choose the correct section if the selected doc contains multiple tool variants. 5. Cite the selected Markdown doc as the payload source in summaries. [...] ## Required workflow 1. Read `AlphaExtractor_api_doc.md` from `https://sciminer.tech/tool_api_files/`. [...] 5. Write or run the invocation code directly from the selected Markdown doc's base-information block, parameter table, file-upload instructions, and example code. Do not apply a shared invocation template or local registry abstraction in this skill. ``` ### Technical Analysis The Skill requires the agent to retrieve a mutable Markdown document from an external URL before every invocation. It then instructs the agent to write or run invocation code directly from that document's example code and operational details. ...[truncated 2172 chars]
- Remediation
- ## Remediation Suggestions - Bundle a reviewed invocation implementation inside the Skill instead of executing example code obtained from remote documentation. - Treat remote Markdown exclusively as untrusted reference material and prohibit executing or dynamically translating its code examples. - Hard-code or strictly allowlist the expected HTTPS origin, API endpoint, authentication-header name, HTTP method, upload destination, and redirect behavior. - Reject cross-origin redirects and never forward `SCIMINER_API_KEY` to a destination outside the approved SciMiner origin. - If remote machine-readable specifications are necessary, pin an approved version or cryptographic digest and verify it before use. - Parse only a narrow, validated data schema. Do not permit fetched content to define executable code, shell commands, arbitrary headers, or unrestricted destinations. - Keep credential injection separate from remotely supplied request definitions, and ensure logs, summaries, errors, and generated code never expose the token. - Require explicit review and release of changes to the local invocation implementation when the upstream API contract changes.