T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:24- Finding
Mutable Remote Skill Instructions Installed Without Integrity Verification
- Content
View full analysis
~/.openclaw/skills/wurk-x402/SKILL.md curl -s https://wurkapi.fun/skill.json > ~/.openclaw/skills/wurk-x402/package.json ``` ### Technical Analysis The installation instructions download the Skill definition and package metadata from mutable, service-controlled URLs and overwrite files in the local OpenClaw Skill directory. There is no immutable version identifier, cryptographic checksum, digital signature, or manual verification step. Although the retrieved artifact is Markdown rather than a conventional executable, `SKILL.md` is an instruction payload interpreted by the Agent. Loading remotely supplied Skill instructions can therefore alter Agent behavior after the reviewed package has been published. HTTPS protects data in transit but does not protect against a compromised server, compromised operator account, malicious server administrator, or unexpected modification of the hosted files. The use of `curl -s` also suppresses diagnostic output and does not use `--fail`, so an HTTP error response could be written into the installed file without a clear failure signal. ### Attack Path 1. An attacker compromises `wurkapi.fun`, its deployment pipeline, DNS, or an authorized publishing account. 2. The attacker replaces `skill.md` with instructions that request credentials, weaken safeguards, initiate unauthorized payments, or transmit sensitive information. 3. A user follows the documented installation command. 4. The mutable remote file overwrites the locally reviewed `SKILL.md`. 5. OpenClaw loads the attacker-controlled instructions as a trusted Skill. 6. The Agent follows the substituted instructions with the permissions and data available in its current environment. ### Impact Assessm ...[truncated 498 chars]- Remediation
View remediation