T03 · Remote Payload Retrieval and Execution
Warning
- Location
- SKILL.md:21
- Finding
- Unverified Remote Skill Replacement<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 21-26 **Vulnerability Type**: Unverified remote instruction update **Risk Level**: Medium ### Vulnerable Code ```markdown ### When User Asks to Update Skills If the user asks you to update Kybera skills (e.g., "update your Kybera skills", "check for skill updates"): 1. Fetch `https://app.kybera.xyz/SKILL.md` 2. Compare the `version` in the YAML frontmatter to your cached version 3. If remote version is higher (e.g., 1.1.0 > 1.0.0), overwrite `~/.openclaw/skills/kybera.md` 4. Confirm the update to the user with old and new version numbers ``` A related instruction at lines 929-933 also encourages retrieval of the latest remote Skill: ```markdown ## Stay Updated This skill file may be updated with new actions and capabilities. If functionality seems missing, ask the user to request a skill update, or fetch the latest from `https://app.kybera.xyz/SKILL.md`. ``` ### Technical Analysis The update mechanism treats a remote YAML `version` value as sufficient authorization to replace the locally cached Skill. It does not require a cryptographic signature, pinned digest, authenticated release manifest, security review, or comparison against a trusted action allowlist. A Skill file contains behavior-controlling instructions. Replacing it with remotely mutable content therefore changes the effective Agent payload after the reviewed package has been installed. HTTPS protects transport under normal conditions but does not protect against compromise of the application domain, DNS, hosting account, deployment pipeline, or signing authority. The update is nominally initiated by a user request, and no evidence establishes that the current remote domain is malicious. Nevertheless, the absence of content-integrity verification creates a credible supply-chain attack surface. ### Attack Path 1. An attacker compromises `app.kybera.xyz`, its DNS, hosting environment, or deployment pipeline. 2. The at ...[truncated 1554 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Publish signed Skill releases and verify each update against a public key pinned in the trusted local package. 2. Retrieve the expected digest from a separately authenticated release manifest and verify the downloaded file before installation. 3. Do not trust the remote file's self-declared version as proof of authenticity. 4. Display the source URL, old and new hashes, version change, and a security-relevant instruction diff before requesting explicit user approval. 5. Validate all remotely supplied action names and parameters against a locally maintained allowlist that remote Skill content cannot modify. 6. Write updates to a temporary file, verify them, and perform an atomic replacement only after all checks pass. 7. Retain a verified rollback copy and restore it automatically if parsing, signature verification, or policy validation fails. 8. Disable automatic update suggestions when the integrity-verification mechanism is unavailable. ]]>