T08 · Insecure Dependencies
Warning
- Location
- references/cli-installation.md:24
- Finding
- Mutable Remote Installer Executed Without Cryptographic Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `references/cli-installation.md`, lines 24–40 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash BASE=https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest curl -sSL "$BASE/hcloud_install.sh" -o ./hcloud_install.sh # Review the script source and content before execution: less ./hcloud_install.sh bash ./hcloud_install.sh ``` The document also provides a non-interactive variant: ```bash BASE=https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest curl -sSL "$BASE/hcloud_install.sh" -o ./hcloud_install.sh # Review the script source and content before execution: less ./hcloud_install.sh bash ./hcloud_install.sh -y ``` ### Technical Analysis The installation instructions retrieve a shell script from a mutable `latest` URL and subsequently execute it. They do not pin a specific KooCLI release or verify an official checksum or cryptographic signature. HTTPS protects the download in transit under normal conditions, but it does not establish that the retrieved file is the exact artifact reviewed or intended by the project. The effective installer can change after this Skill has been audited because the URL points to a mutable location. A compromised distribution endpoint, storage account, DNS/TLS trust path, or release process could therefore replace the installer with attacker-controlled code. The recommendation to inspect the script manually with `less` is helpful but is not a reliable integrity control. Complex or obfuscated behavior can evade visual review, and the non-interactive `-y` variant can reduce opportunities to identify unexpected actions during installation. The instructions explicitly state that the user, rather than the Agent, must perform the download and installation. This limits automatic exploitation through the Skill itself, but users following the documented procedure remain exposed to supply-ch ...[truncated 1459 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the mutable `latest` URL with a pinned, explicitly approved KooCLI version. 2. Publish the expected SHA-256 or stronger digest through an independent trusted channel and verify it before execution, for example: ```bash printf '%s %s\n' '<official-sha256>' 'hcloud_install.sh' | sha256sum --check - ``` 3. Prefer vendor-provided cryptographic signatures and verify them against a pinned, independently authenticated signing key. 4. Stop installation immediately if checksum or signature verification fails. 5. Prefer a verified operating-system package manager or another installation channel that provides package signing and version pinning. 6. Preserve manual source review as defense in depth, but do not treat it as a replacement for cryptographic verification. 7. Avoid the non-interactive `-y` option unless the artifact has already passed integrity and authenticity checks. 8. Execute the installer with the least privileges required, and review any privilege-escalation request before granting it. 9. Document the expected version, checksum, signer identity, and verification procedure together so users can validate the exact reviewed artifact. ]]>