T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:45- Finding
Mutable Remote Documentation Is Used to Generate and Execute Authenticated Invocation Code
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 45-88
Vulnerability Type: Unpinned remote payload retrieval and execution
Risk Level: HighVulnerable Code Snippet
markdown The published Markdown files under `https://sciminer.tech/tool_api_files/` are the single source of truth for `provider_name`, `tool_name`, allowed `parameters`, file-upload behavior, request encoding, and the example submission flow for this skill's included tools. Use these SciMiner Markdown docs: - `REINVENT4` -> `REINVENT4_api_doc.md` - `PocketXMol` -> `PocketXMol_api_doc.md` - `fpocket` -> `fpocket_api_doc.md` - `Gnina Score` -> `Gnina Score_api_doc.md` The agent MUST: 1. Resolve the selected tool's Markdown file and read it before every invocation. 2. Never invent `provider_name`, `tool_name`, parameter names, enum values, upload-field names, content type, or submission flow from memory. 3. Extract and follow the selected doc section's exact: - Base URL - API endpoint - Content-Type - Authentication header - Tool Name - Method - Parameter table, including required fields and enum values - File-upload instructions and example code 4. Choose the correct section if the selected doc contains multiple tool variants, such as structure-free generation vs pocket-guided design. 5. Cite the selected Markdown doc as the payload source in summaries. If a user-provided parameter is not present in the selected Markdown doc section, ask for correction or drop it with an explanation. ## Required workflow 1. Determine whether the request is structure-free generation, structure-based design, pocket detection, or post-generation scoring. 2. Read the corresponding Markdown file or files from `https://sciminer.tech/tool_api_files/`. 3. When structure-based design has no explicit pocket input, read the `fpocket` doc first and run that step before `Pock ...[truncated 3866 chars]- Remediation
View remediation
Remediation Suggestions
- Vendor reviewed API schemas and invocation templates into the skill package rather than generating executable behavior from live documentation.
- If remote retrieval is operationally required, pin each document to an immutable version and verify a cryptographic digest or trusted digital signature before parsing it.
- Treat downloaded documentation as untrusted data, never as agent instructions or executable code. Do not execute example code obtained from the documentation.
- Hardcode and allowlist the expected HTTPS origin, API endpoints, HTTP methods, authentication-header name, and upload destination in reviewed local configuration.
- Reject redirects, cross-origin endpoint substitutions, non-HTTPS destinations, embedded shell commands, and undocumented request fields.
- Construct requests through a fixed local client with a strict schema. Only permit remote documentation to supply non-security-sensitive descriptive metadata.
- Ensure the API key is attached only after the final destination has been validated against the allowlist. Prevent authorization headers from being forwarded across redirects.
- Limit file access to files explicitly supplied or approved by the user, enforce size and type limits, and display the validated upload destination before transmitting sensitive research data.
- Use a narrowly scoped and revocable SciMiner token, rotate it after suspected exposure, and avoid granting it permissions unrelated to task submission and result retrieval.
- Run network and invocation operations in a sandbox that denies arbitrary shell execution and restricts outbound traffic to approved SciMiner endpoints.