T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:12
- Finding
- Unpinned Remote Payload Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 12–17; execution examples at lines 32–55 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -sL https://raw.githubusercontent.com/2b-jr26/lovense-cli/main/lovense.py -o lovense.py chmod +x lovense.py ``` The downloaded file is subsequently invoked using commands such as: ```bash SCRIPT="{baseDir}/lovense.py" python3 $SCRIPT <ip> <port> gettoys python3 $SCRIPT <ip> <port> vibe 12 6 python3 $SCRIPT <ip> <port> stop ``` ### Technical Analysis The Skill instructs users or agents to download a Python program from the mutable `main` branch of a personal GitHub repository and execute it locally. The downloaded source is not included in the audited package, so its behavior cannot be verified as part of this audit. The retrieval process provides no immutable commit pin, expected cryptographic digest, signature verification, or other integrity control. Consequently, the effective program can change after the Skill has been reviewed. Compromise of the upstream account or repository, a malicious upstream update, or unauthorized modification of the branch could replace the expected utility with arbitrary Python code. The use of `curl -sL` also suppresses useful diagnostics and does not use `--fail`, while `chmod +x` unnecessarily marks the payload executable because the documented commands invoke it through `python3`. These choices increase the chance that users will treat an unaudited remote file as trusted executable content. The declared LAN-control functionality does not inherently require fetching mutable executable code at installation time. Bundling a reviewed implementation within the Skill would satisfy the stated function with a smaller supply-chain trust boundary. ### Attack Path 1. An attacker compromises the upstream GitHub account or repository, or otherwise gains permission to mod ...[truncated 1457 chars]
- Remediation
- ## Remediation Suggestions 1. Include `lovense.py` directly in the Skill package so that its exact contents can be reviewed and distributed with the audited artifact. 2. If remote retrieval is unavoidable, pin the URL to an immutable, reviewed commit rather than the mutable `main` branch. 3. Publish an expected SHA-256 digest through a trusted channel and verify it before any execution. Abort on mismatch. 4. Prefer cryptographic signature verification with a documented, trusted public key where maintainable release signing is available. 5. Use strict download behavior, including `curl --fail --show-error --location`, and write to a controlled destination only after validation. 6. Require explicit user approval before retrieving or executing external code, clearly displaying the source URL, pinned revision, and verification result. 7. Remove `chmod +x` unless direct execution is necessary; invoking a verified file through `python3` does not require executable permission. 8. Review the bundled or pinned script for its network destinations, command construction, input validation, file access, and handling of device-control requests before release. 9. Run the utility with only the minimum account and filesystem permissions needed for local-network device control.