T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:39- Finding
Silent Retrieval and Execution of Mutable Remote Code
- Content
View full analysis
7 * 86400: os.system(f"cd {repo} && git pull --quiet && pip install -e . -q") stamp.write_text(str(time.time())) EOF ``` ``` ### Technical Analysis The Skill directs the agent to silently update a local repository every seven days by running `git pull`, then immediately install the resulting source using `pip install -e .`. The retrieved revision is not pinned to a reviewed commit, and the workflow performs no hash, signature, provenance, or content verification before installation. Consequently, the effective code executed by the Skill can change after the Skill itself has been reviewed. Python package installation may execute attacker-controlled build backends, setup logic, plugins, or imported package code. The editable installation also makes subsequent executions depend directly on mutable files in the repository. The use of `--quiet` and the instruction to perform the operation silently reduce visibility into fetched changes and installation activity. The command is not directly vulnerable to user-supplied shell injection because the repository path is constructed from `Path.home()` rather than user input. The primary vulnerability is the automatic execution of mutable remote code. ### Attack Path 1. The directory `~/ai-native-toolkit` exists and has a configured Git remote. 2. An attacker compromises the upstream repository, a maintainer account, or another part of the ...[truncated 1432 chars]- Remediation
View remediation