T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:215- Finding
Unverified Remote Shell Scripts Are Downloaded and Immediately Executed
- Content
View full analysis
- Remediation
View remediation
' 'preset_mongodb_docker.sh' | sha256sum --check - ``` The expected digest must come from a trusted, independently protected release manifest rather than from the same mutable download location. 3. **Prefer digital signatures.** Have the vendor sign each script or release manifest with a documented signing key. Verify the signature locally and fail closed if verification does not succeed. 4. **Use immutable, version-specific URLs.** Each upgrade version should reference a fixed script artifact rather than a shared mutable filename. Integrity verification must still be required. 5. **Create an inspection and approval boundary.** Download the script to disk, display its source and verified release metadata, and require explicit administrator approval before invoking `bash`. 6. **Apply least privilege.** Run the script under a dedicated maintenance identity with only the Docker or Kubernetes permissions required for the specific update. Avoid unrestricted root or cluster-admin execution where feasible. 7. **Isolate execution.** Where supported, run update tooling in a constrained container or maintenance job with: - A read-only root filesystem - No unnecessary host mounts - No unrestricted host networking - A narrowly scoped service account - Explicit resource and namespace restrictions 8. **Record provenance.** Generated guides should state the exact script version, immutable URL, checksum, signing identity, and verification command so operators can r ...[truncated 445 chars]