T03 · Remote Payload Retrieval and Execution
Error
- Location
install.sh:4- Finding
Installation Executes Unpinned Code from a Mutable Remote Repository
- Content
View full analysis
/dev/null; then echo "✅ mail-mcp 已安装: $(which mail-mcp)" else echo "📦 正在安装 mail-mcp..." pip install git+$REPO_URL --break-system-packages -q ``` The same unsafe installation method is recommended in `SKILL.md:24-36`: ```bash pip install git+https://github.com/AdJIa/mail-mcp-server.git ``` ```bash git clone https://github.com/AdJIa/mail-mcp-server.git cd mail-mcp-server pip install -e . ``` ### Technical Analysis The installer retrieves and installs Python code directly from the default branch of an external Git repository. It does not pin the dependency to an audited commit, verify a cryptographic hash, or validate a signed release. Consequently, the code executed during installation can change after this Skill has been reviewed. Python package installation can execute attacker-controlled build backend or packaging logic. If the upstream repository, maintainer account, release process, or network trust assumptions are compromised, a subsequent invocation can execute a payload that was not present during the audit. The `--break-system-packages` option additionally bypasses protections intended to prevent pip from modifying a system-managed Python environment. This can overwrite or conflict with operating-system packages, expanding the potential impact beyond an isolated application environment. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or its default branch. 2. The attacker adds malicious packaging or runtime code to the remote project. 3. A user runs `install.sh` or follows the installation command in `SKIL ...[truncated 1023 chars]- Remediation
View remediation
" ``` 2. Prefer a versioned, signed release from a trusted package registry. Require hash verification through a locked requirements file: ```text mail-mcp== --hash=sha256: ``` 3. Verify release signatures or repository commit signatures before installation. 4. Remove `--break-system-packages`. Install into a dedicated virtual environment or another isolated runtime: ```bash python3 -m venv "$HOME/.local/share/mail-mcp/venv" "$HOME/.local/share/mail-mcp/venv/bin/python" -m pip install \ --require-hashes -r requirements.lock ``` 5. Display the exact version or commit being installed and require explicit user confirmation before downloading and executing external code. 6. Review and lock all transitive dependencies. Use automated dependency and provenance checks in the release process. ]]>