T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:147
- Finding
- Mutable Remote Skill Updates Can Replace Trusted Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 147–199 **Vulnerability Type**: Remote instruction payload retrieval and persistent replacement **Risk Level**: High ### Vulnerable Code Snippet ```markdown ## Automatic update check At the start of each **new session** (not every turn): 1. Read `plan.skill.installed_version`. 2. `GET https://www.nichestarter.ai/api/gtm/agent`. 3. Read `skill_release.version`, `plan_schema_version`, `changelog_url`, and `skill_url`. ... ### On refresh approval Reload, in order: 1. canonical `skill_release.skill_url`; 2. the selected file from `stages/index.md`; 3. the bound `project_type_playbook_url`, or the selected file from `project-types/index.md`; 4. `channels/index.md` (router only); ... Also overwrite this host’s persisted `gtm-coach/` skills folder so the next session is not stuck on the old copy. ... - Trust update metadata only from `https://www.nichestarter.ai/api/gtm/agent` and HTTPS URLs on `www.nichestarter.ai`. ``` ### Technical Analysis The skill automatically contacts a remote update manifest at the start of every new session. After user approval, it loads instruction files from URLs supplied by that manifest and overwrites the locally persisted skill bundle. Markdown skill files are executable instruction payloads in the context of an AI agent: loading a modified `SKILL.md` or module can change tool use, filesystem operations, network behavior, and safety constraints. Consequently, the behavior is equivalent to retrieving and activating a mutable remote payload after the installed package has been audited. Restricting URLs to `www.nichestarter.ai` reduces arbitrary-domain injection but does not provide payload immutability. A compromise of the website, update API, deployment pipeline, DNS/TLS termination, or publisher account could distribute instructions materially different from the reviewed version. There is no documented signature verification, pinned digest, immutabl ...[truncated 1671 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove automatic loading of mutable remote skill instructions during ordinary coaching sessions. 2. Distribute updates as versioned, immutable release archives rather than mutable URLs. 3. Publish a cryptographic SHA-256 digest and a signature for every complete bundle. 4. Pin the expected signing key locally and verify both the signature and digest before loading any file. 5. Require explicit user approval before downloading, not merely before overwriting the installed copy. 6. Display a local diff of all instruction changes before activation. 7. Stage updates in a temporary directory and validate the complete bundle before replacing the installed version. 8. Reject manifest redirects, cross-origin URLs, unexpected files, path traversal, and unsigned modules. 9. Preserve the previous verified version and provide an atomic rollback mechanism. 10. Treat update metadata and release notes as untrusted data rather than executable agent instructions. 11. Prefer package-manager or marketplace update mechanisms that provide provenance, review history, and immutable versioning. ]]>