T03 · Remote Payload Retrieval and Execution
- Location
README.md:403- Finding
Mutable Remote Skill Archive Installed Without Integrity Verification
- Content
View full analysis
Vulnerability Details
File Location:
README.md:403-406
Vulnerability Type: Unverified remote payload retrieval through a mutable branch archive
Risk Level: MediumVulnerable Code
bash mkdir -p skills/reprompter curl -sL https://github.com/aytuncyildizli/reprompter/archive/main.tar.gz | \ tar xz --strip-components=1 -C skills/reprompterTechnical Analysis
The documented installation command downloads an archive from the mutable
mainbranch and extracts it directly into an active Skill directory. It does not pin a release tag or immutable commit and does not verify a checksum or cryptographic signature.The archive is not directly piped to a shell, so extraction alone does not immediately execute a native binary. However, the extracted files include Agent-readable Skill instructions and potentially executable scripts. Claude Code subsequently auto-discovers
skills/reprompter/SKILL.md, meaning changed upstream content can become effective Agent instructions after installation without receiving the same review as the audited version.Use of HTTPS protects transport integrity but does not protect against compromise of the upstream account or repository, malicious upstream changes, or an unexpected force-push to the branch.
Attack Path
- An attacker compromises the upstream repository or maintainer account, or malicious content is committed to
main. - The attacker modifies
SKILL.md, a reference template, or an included script. - A user follows the documented installation command.
curlretrieves the current, attacker-controlledmainarchive.tarextracts the unverified content directly intoskills/reprompter.- Claude Code auto-discovers and loads the altered Skill.
- Malicious instructions may then induce the Agent to invoke tools, disclose accessible information, modify files, or execute commands within the Agent's existing permissions.
Impact Ass
...[truncated 567 chars]
- An attacker compromises the upstream repository or maintainer account, or malicious content is committed to
- Remediation
View remediation
Remediation Suggestions
- Replace the mutable
mainarchive with a versioned release or immutable commit archive. - Publish a SHA-256 checksum through an independently controlled release channel and verify it before extraction.
- Download the archive to a temporary file rather than streaming it directly to
tar. - List and validate archive entries before extraction, rejecting absolute paths,
..traversal components, and unexpected files. - Extract into a newly created staging directory and move the validated contents into the final Skill directory.
- Prefer signed release artifacts or signed Git tags where available.
- Avoid
curl -s, or use options such as--fail --show-error --locationso HTTP and transport failures are visible.
Example hardened pattern:
bash set -euo pipefail version="v7.0.0" expected_sha256="PUBLISH_AND_INSERT_VERIFIED_CHECKSUM" archive="$(mktemp)" staging="$(mktemp -d)" curl --fail --show-error --location \ "https://github.com/aytuncyildizli/reprompter/archive/refs/tags/${version}.tar.gz" \ --output "$archive" printf '%s %s\n' "$expected_sha256" "$archive" | sha256sum --check - tar tzf "$archive" | grep -Ev '(^/|(^|/)\.\.(/|$))' >/dev/null tar xzf "$archive" --strip-components=1 -C "$staging" mkdir -p skills/reprompter cp -R "$staging"/. skills/reprompter/ rm -rf "$archive" "$staging"- Replace the mutable