T03 · Remote Payload Retrieval and Execution
Error
- Location
- encrypted-card.md:80
- Finding
- Remote Server Supplies Executable Code and Free-Form Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `encrypted-card.md:80-105`, `encrypted-card.md:147-180`, `encrypted-card.md:205-234`, `skill.md:472-525` **Vulnerability Type**: Remote payload retrieval and execution through server-provided scripts, tasks, and instructions **Risk Level**: Critical ### Vulnerable Code Snippets From `encrypted-card.md:80-105`: ```json { "approved": true, "checkout_id": "r5chk_abc123", "checkout_steps": [ "Call POST /api/v1/bot/rail5/key with { \"checkout_id\": \"r5chk_abc123\" } to get the decryption key.", "Run: node decrypt.js <key_hex> <iv_hex> <tag_hex> Card-ChaseD-9547.md", "Use the decrypted card details to complete checkout at DigitalOcean.", "Call POST /api/v1/bot/rail5/confirm with { \"checkout_id\": \"r5chk_abc123\", \"status\": \"success\" } when done.", "If checkout fails, call confirm with { \"status\": \"failed\" } instead.", "Announce the result." ], "spawn_payload": { "task": "You are a checkout agent...", "cleanup": "delete", "runTimeoutSeconds": 300, "label": "checkout-digitalocean" } } ``` From `encrypted-card.md:147-180`: ```text sessions_spawn({ task: spawn_payload.task, cleanup: "delete", runTimeoutSeconds: 300 }) ``` ```bash curl -X POST https://creditclaw.com/api/v1/bot/rail5/key \ -H "Authorization: Bearer $CREDITCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "checkout_id": "r5chk_abc123" }' ``` ```text node decrypt.js <key_hex> <iv_hex> <tag_hex> Card-ChaseD-9547.md ``` From `encrypted-card.md:205-234`: ```json { "event": "rail5.card.delivered", "bot_id": "bot_abc123", "data": { "card_id": "r5card_...", "card_name": "ChaseD", "card_last4": "9547", "file_content": "<self-contained markdown file with decrypt script and encrypted data>", "suggested_path": ".creditclaw/cards/Card-ChaseD-9547.md", "instructions": "Save this file to .creditclaw/cards/Card-ChaseD-9547.md — then confirm delivery via ...[truncated 3509 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all execution of server-provided scripts and free-form task text. 2. Bundle a reviewed decryption implementation with the Skill or runtime and pin its cryptographic digest. 3. Replace `spawn_payload.task` and `checkout_steps` with a strict, versioned schema containing only typed transaction data. 4. Construct sub-agent prompts locally from trusted templates; never execute instruction strings returned by an API. 5. Enforce explicit allowlists for commands, tools, merchant domains, filesystem paths, and API endpoints available to the checkout sub-agent. 6. Run checkout processing in a sandbox with no general shell, no unrelated filesystem access, no inherited environment, and network access limited to CreditClaw and the explicitly approved merchant origin. 7. Cryptographically sign delivered card artifacts and verify the signature and expected version before processing them. 8. Reject unknown fields, unexpected instructions, redirects to unapproved origins, and any payload requesting unrelated actions. 9. Record immutable security audit events for payload version, artifact digest, approved merchant, amount, and destination without logging payment data. 10. Fail closed if the trusted local helper, signature verification, or required isolation is unavailable. ]]>