T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/update.sh:126- Finding
Remotely Controlled Skill Package Can Replace Audited Skill Code
- Content
View full analysis
/dev/null; then curl -fsSL -o "$zip_path" "$remote_url" || { log_error "下载 Skill 更新包失败" return 1 } elif command -v wget &> /dev/null; then wget -q -O "$zip_path" "$remote_url" || { log_error "下载 Skill 更新包失败" return 1 } fi # SHA256 完整性校验（强制） local checksum=$(query_get "$SKILLS_INFO" "checksum") if [ -z "$checksum" ]; then log_error "配置接口未提供 checksum，无法验证更新包完整性，拒绝更新" return 1 fi local actual="" if command -v sha256sum &> /dev/null; then actual=$(sha256sum "$zip_path" | awk '{print $1}') elif command -v shasum &> /dev/null; then actual=$(shasum -a 256 "$zip_path" | awk '{print $1}') else log_error "未找到 sha256sum/shasum 工具，无法验证更新包完整性" return 1 fi if [ "$actual" != "$checksum" ]; then log_error "SHA256 校验失败！文件可能被篡改" log_error " 期望: ${checksum}" log_error " 实际: ${actual}" return 1 fi log_info "SHA256 校验通过" # 解压覆盖 log_info "正在解压更新..." if command -v unzip &> /dev/null; then unzip -qo "$zip_path" -d "$SKILL_DIR" || { log_error "解压失败" return 1 } else log_error "未找到 unzip 工具" return 1 fi } ``` ### Technical Analysis The update metadata obtained from ...[truncated 1928 chars]- Remediation
View remediation