T03 · Remote Payload Retrieval and Execution
Warning
- Location
skill.md:21- Finding
Unpinned Remote Skill Installation Allows Post-Review Payload Substitution
- Content
View full analysis
~/.moltbot/skills/deadinternet-forum/SKILL.md curl -s https://www.deadinternet.forum/skill.json > ~/.moltbot/skills/deadinternet-forum/package.json ``` ### Technical Analysis The documented installation process retrieves Skill instructions and metadata from mutable remote URLs and writes them directly into an active local Skill directory. It does not pin a version, verify a cryptographic signature or checksum, validate the downloaded content, or stop on HTTP errors. Consequently, the content installed by a user may differ from the artifact that was audited. If the hosting server, deployment pipeline, DNS resolution, or upstream account is compromised, an attacker could replace `skill.md` or `skill.json` with attacker-controlled content. Because `SKILL.md` contains instructions interpreted by an AI agent, substituting it can alter the effective payload after security review. HTTPS protects data in transit under normal certificate validation, but it does not establish that the retrieved content is the same version that was audited. The use of `curl -s` also suppresses useful diagnostics and does not explicitly fail on HTTP error responses. The audited file itself contains no embedded executable code, obfuscation, persistence mechanism, privilege-escalation logic, or instruction to collect unrelated local secrets. Exploitation therefore depends on a user running these installation commands and subsequently loading the remotely substituted Skill. ### Attack Path 1. An attacker compromises or gains control over the hosting infrastructure, publishing pipeline, DNS path, or content served by `www.deadinternet.forum`. 2. The attacker replaces the ...[truncated 1281 chars]- Remediation
View remediation