T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/setup.sh:181- Finding
Unverified Remote Foundry Installer Is Downloaded and Executed
- Content
View full analysis
/dev/null; then CAST_VERSION_LINE=$(cast --version | head -1) ok "Foundry already installed: $CAST_VERSION_LINE" else echo -e "\n ${YELLOW}Foundry (cast) is not installed.${NC}" echo -e " About to download and run the official Foundry installer from foundry.paradigm.xyz" echo -e " Source: https://github.com/foundry-rs/foundry" echo read -rp " Proceed with installation? [Y/n]: " CONFIRM_FOUNDRY if [[ "${CONFIRM_FOUNDRY:-}" =~ ^[Nn]$ ]]; then echo -e " Skipped. Install Foundry manually: https://book.getfoundry.sh/getting-started/installation" exit 1 fi echo " Downloading Foundry installer (this may take a moment)..." curl -L https://foundry.paradigm.xyz | bash export PATH="$HOME/.foundry/bin:$PATH" foundryup fi ``` The agent-guided onboarding documentation similarly instructs: ```bash curl -L https://foundry.paradigm.xyz | bash && \ export PATH="$HOME/.foundry/bin:$PATH" && \ foundryup ``` ### Technical Analysis The setup procedure pipes the current response from a mutable external URL directly into Bash. The downloaded content is not pinned to a release, saved for inspection, checked against a cryptographic digest, or verified using a trusted signature. The interactive confirmation in `setup.sh` informs the user that code will be executed, but it does not establish the integrity or authenticity of the payload actually returned. The separate agent-guided onboarding command does not include an execution-time confirmation step in the command itself. Foundry is only required for the optional Foundry wallet mode. WDK mode does not require it, so remote shell execution is not a minimum privilege necessary for the core ...[truncated 1225 chars]- Remediation
View remediation