T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/lib.sh:10- Finding
Unverified Remote Replacement of Executable Skill Scripts
- Content
View full analysis
/dev/null | tr -d '[:space:]') # Validate local version before integer comparisons [[ "$local_ver" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || return 0 # Fetch remote version with 5s timeout, check HTTP status response=$(curl -sS --max-time 5 -w "\n%{http_code}" "$REMOTE_VERSION_URL" 2>/dev/null) || return 0 http_code=$(echo "$response" | tail -1) remote_ver=$(echo "$response" | head -1 | tr -d '[:space:]') # Only compare if HTTP 200 and valid semver-like format [[ "$http_code" == "200" && "$remote_ver" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || return 0 # Same version, skip [ "$local_ver" != "$remote_ver" ] || return 0 # Parse semver: major.minor.patch local local_major local_minor local_patch local remote_major remote_minor remote_patch IFS='.' read -r local_major local_minor local_patch <<< "$local_ver" IFS='.' read -r remote_major remote_minor remote_patch <<< "$remote_ver" if [ "$remote_major" -gt "$local_major" ] || \ { [ "$remote_major" -eq "$local_major" ] && [ "$remote_minor" -gt "$local_minor" ]; }; then local base_url="https://raw.githubusercontent.com/marswaveai/skills/main/skills/listenhub" local api_url="https://api.github.com/repos/marswaveai/skills/contents/skills/listenhub/scripts" local update_success=true if ! curl -fsSL --max-time 10 "$base_url/VERSION" -o "$VERSION_FILE.tmp" 2>/dev/null; then update_success=false fi if [ "$update_success" = true ]; then lo ...[truncated 2669 chars]- Remediation
View remediation