T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:58
- Finding
- Execution of an Untrusted Upgrade Command Supplied Through CLI Output## Vulnerability Details **File Location**: `SKILL.md:58` **Vulnerability Type**: Remote command retrieval and execution **Risk Level**: High **Relevant instruction translated from the source**: ```text If the command returns {"ok":false,"stage":"version",...}, the message contains the upgrade command; execute it as instructed. ``` ### Technical Analysis The Skill instructs the Agent to execute an upgrade command obtained dynamically from the `message` field returned by `qhkit`. The command is not constrained to a fixed allowlist, parsed as structured version data, or verified before execution. This creates an indirect remote command-execution channel. If the CLI package, its backend service, the service response path, or a related dependency is compromised, the returned message could contain an arbitrary shell command. Following the Skill's instruction would then execute attacker-controlled content with the privileges of the Agent process. The risky behavior is distinct from the checksum pipeline at lines 48–49. That pipeline does not pipe `curl` output into a shell; it pipes a checksum record into `sha256sum -c`. The vulnerability here is the instruction to execute command text obtained from a mutable external response. ### Attack Path 1. The Agent invokes `qhkit` for a video-processing operation. 2. A compromised CLI, backend service, dependency, or response path returns a result with `stage` set to `version`. 3. The attacker places a malicious shell command in the returned `message` field. 4. The Skill directs the Agent to execute the command without validation. 5. The command runs under the local account hosting the Agent. 6. The attacker can access or modify resources available to that account and may install additional payloads. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the Agent user. Potential impact includes reading accessible files and env ...[truncated 443 chars]
- Remediation
- ## Remediation Suggestions - Never execute commands copied from CLI output, standard error, API responses, model output, or service-provided messages. - Treat the `message` field as display-only text. - Replace the instruction with a fixed, reviewed upgrade workflow. - Parse only a strictly validated semantic version from structured data and construct the command locally. - Pin upgrades to an explicitly approved version rather than accepting arbitrary command text or `latest`. - Require explicit user approval before installing or upgrading executable software. - Run package management and media-processing commands under an unprivileged, isolated account. - Reject shell metacharacters and unexpected fields if any remote version metadata must be consumed.