T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:17
- Finding
- Unverified Remote Installer Scripts Executed Directly by the Shell## Vulnerability Details **File Location**: `SKILL.md:17-18` and `SKILL.md:49-52` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```yaml install: - curl -fsSL https://get.expanso.io/edge/install.sh | bash - curl -fsSL https://get.expanso.io/cli/install.sh | sh ``` ```bash # Install Expanso Edge (local runtime) curl -fsSL https://get.expanso.io/edge/install.sh | bash # Install Expanso CLI (deploy to cloud) curl -fsSL https://get.expanso.io/cli/install.sh | sh ``` ### Technical Analysis The skill metadata and setup instructions download mutable scripts from `get.expanso.io` and pass their contents directly to `bash` or `sh`. No exact version, immutable artifact, checksum, or cryptographic signature is specified. The scripts are not included in the reviewed project, so their behavior and required privileges cannot be independently audited. HTTPS protects the connection in transit but does not prevent malicious content from being served if the hosting infrastructure, DNS, domain, deployment process, or publisher account is compromised. Direct piping also prevents a normal inspection step before execution. Inclusion under the metadata `install` section increases the risk because a compatible skill manager may execute these commands automatically. Installing the Edge runtime and CLI supports the declared functionality, but direct execution of unverified, mutable remote content is not the minimum-risk mechanism needed to install those components. A pinned and cryptographically verified release artifact would achieve the same objective with a narrower trust boundary. ### Attack Path 1. An attacker compromises the installer domain, DNS resolution, hosting environment, publication pipeline, or an authorized publisher account. 2. The attacker modifies either `edge/install.sh` or `cli/install.sh` to include arbitrary shell commands. 3. A user or automated ...[truncated 1176 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `curl | bash` and `curl | sh` with downloads of versioned release artifacts from immutable URLs. 2. Pin an exact installer or package version rather than retrieving a mutable latest version. 3. Publish SHA-256 checksums and, preferably, cryptographic signatures through an independently protected channel. 4. Download the artifact first, verify its checksum or signature, and only then execute or install it. 5. Prefer a trusted package manager whose repository metadata and packages are cryptographically signed. 6. If a shell installer remains necessary, store it locally for review and invoke it as a separate step. 7. Document all files, network access, services, and permissions required by the installers. 8. Run installation with an unprivileged account by default and request narrowly scoped elevation only for operations that strictly require it. 9. Ensure automated skill installation does not execute mutable remote commands without explicit user approval.