T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:26
- Finding
- Untrusted Remote Solution Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 26–73 and 232–249 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```javascript async function evomapQuery(signals) { const timestamp = new Date().toISOString(); const messageId = `msg_${Date.now()}_${Math.random().toString(16).slice(2,6)}`; const response = await fetch('https://evomap.ai/a2a/fetch', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ protocol: 'gep-a2a', protocol_version: '1.0.0', message_type: 'fetch', message_id: messageId, sender_id: 'node_9e601234', timestamp: timestamp, payload: { signals: signals, limit: 5 } }) }); return response.json(); } async function autoReuse(signals) { // 1. Query const result = await evomapQuery(signals); // 2. Match if (result.payload?.results?.length > 0) { const best = result.payload.results[0]; // 3. Extract solution const solution = best.payload; // 4. Record reuse await recordReuse(signals, best); // 5. Report result later setTimeout(() => reportUsage(best.asset_id, true), 60000); return { reused: true, solution, asset: best }; } return { reused: false }; } ``` The usage example then directs the consumer to apply the returned solution: ```javascript if (!solution) { const result = await evomapQuery(errorSignals); if (result.payload?.results?.[0]) { solution = result.payload.results[0]; // Update local cache updateLocalCache(errorSignals, solution); } } // Use solution if (solution) { console.log('Reused solution:', solution.payload?.summary); // Execute solution... } ``` ### Technical Analysis The Skill retrieves mutable content from `https://evomap.ai/a2a/fetch`, selects the first result, extracts its payload as a solution, and directs the Agent to use or e ...[truncated 1826 chars]
- Remediation
- ## Remediation Suggestions 1. Treat every remote response as untrusted data rather than executable instructions. 2. Replace free-form solution payloads with a strict, versioned schema containing only declarative, allowlisted operations. 3. Reject payloads containing shell commands, tool directives, prompt instructions, arbitrary URLs, filesystem paths, or unsupported fields. 4. Require assets to be signed by approved publishers and verify signatures locally before use. 5. Pin each approved asset to a cryptographic digest and reject any digest mismatch. 6. Require explicit, informed user approval before applying or caching a newly retrieved solution. 7. Display the source, digest, requested operations, affected resources, and expected network activity during approval. 8. Execute approved operations in a least-privilege sandbox with restricted filesystem, process, credential, and network access. 9. Do not automatically select the first search result; enforce publisher trust, compatibility, safety-policy, and integrity checks. 10. Disable automatic usage reporting until the user has consented to the disclosed data transfer. 11. Add response-size limits, content-type validation, timeout handling, schema validation, and safe failure behavior. 12. Maintain an auditable local allowlist of reviewed assets and do not update it directly from untrusted search responses.