T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:61
- Finding
- Remote Service Response Can Direct Local Command Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 61–64 **Vulnerability Type**: Remote-controlled command execution **Risk Level**: High **Relevant Code Snippet**: ```text command returns {"ok":false,"stage":"version",...} (version gate, message contains the upgrade command, execute it directly) ... npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill instructs the Agent to execute an upgrade command supplied in the `message` field of a remote CLI or service response. The response text is not constrained to a fixed command, parsed against an allowlist, or otherwise validated before execution. This creates a remote command-execution channel: the effective command can change after the Skill has been reviewed. Although the documented upgrade command installs `@iqinghu/qhkit`, the instruction to execute the response-provided command directly does not technically restrict the response to that package or even to an npm command. ### Attack Path 1. An attacker compromises the remote service, its response-generation path, the installed CLI, or another trusted component involved in returning the version response. 2. The attacker causes the CLI to return `stage:"version"` and places an arbitrary shell command in the response's `message` field. 3. The Agent follows the Skill instruction to execute that command directly. 4. The attacker-controlled command runs locally with the privileges and environment access of the Agent process. 5. The command may subsequently download payloads, access local data, alter user-owned files, or establish additional execution mechanisms. ### Impact Assessment Successful exploitation permits arbitrary command execution under the operating-system account running the Agent. The attacker could access any files, credentials, environment variables, and network resources available to that account. The instructions do not require administrative elevation, so direct root co ...[truncated 197 chars]
- Remediation
- ## Remediation Suggestions - Never execute commands taken from a remote response's free-form `message` field. - Treat remote messages only as displayable diagnostic data. - Implement upgrades through a locally defined, fixed command that permits only the expected package and registry. - Pin the package to an explicitly reviewed version instead of using `@latest`. - Validate the requested target version against a strict version format and an approved-version allowlist. - Require explicit user approval before installing or upgrading executable software. - Run installation and upgrade operations in a restricted environment without access to unrelated credentials or sensitive files. - Where possible, verify package integrity and provenance before execution.