T03 · Remote Payload Retrieval and Execution
Error
- Location
install.sh:4- Finding
Unpinned Remote Repository Is Installed as Executable Code
- Content
View full analysis
/dev/null; then echo "✅ mail-mcp 已安装: $(which mail-mcp)" else echo "📦 正在安装 mail-mcp..." pip install git+$REPO_URL --break-system-packages -q ``` The same insecure installation approach is recommended in `SKILL.md`, lines 24-31: ```bash pip install git+https://github.com/AdJIa/mail-mcp-server.git ``` ```bash git clone https://github.com/AdJIa/mail-mcp-server.git cd mail-mcp-server pip install -e . ``` ### Technical Analysis The installer retrieves and installs Python code directly from the current head of a remote Git repository. It does not pin a reviewed commit hash or immutable release, nor does it verify a cryptographic checksum or signature. Consequently, the effective code executed by the installation process can change after this Skill has been reviewed. A compromise of the upstream repository, maintainer account, Git hosting account, or dependency publication process could cause future installations to execute attacker-controlled build or installation logic. The use of `--break-system-packages` further weakens isolation by bypassing protections intended to prevent pip from modifying an externally managed Python installation. This can overwrite or conflict with system-managed packages and expand the consequences of a malicious or defective package. Fetching the external Mail MCP implementation is related to the declared functionality, but using a mutable source and bypassing package-management safeguards exceeds the minimum risk necessary to provide that functionality. ### Attack Path 1. An attacker compromises the upstream Gi ...[truncated 1363 chars]- Remediation
View remediation
" ``` 2. Prefer a versioned, signed release from a controlled package registry. Require hashes through a locked requirements file where supported: ```text mail-mcp== --hash=sha256: ``` 3. Verify release signatures or checksums before installation and document how the expected values are obtained through a trusted channel. 4. Remove `--break-system-packages`. Install into an isolated virtual environment or another sandboxed runtime: ```bash python3 -m venv "$HOME/.local/share/mail-mcp/venv" "$HOME/.local/share/mail-mcp/venv/bin/python" -m pip install \ "git+https://github.com/AdJIa/mail-mcp-server.git@" ``` 5. Review the pinned upstream source, its build backend, transitive dependencies, and runtime network behavior before distributing the Skill. 6. Fail closed if integrity verification fails rather than falling back to the repository's current default branch. ]]>