T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:108
- Finding
- Mutable Remote JavaScript Is Downloaded and Executed Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md`, lines 108-118 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable Code**: ```markdown 1) Generate a local profile file (with sensitive values) at runtime (example filename: `./profile.json`). 2) Fetch `cli.mjs`. 3) Run `--run-profile` pointing at the local profile file. Primary (recommended) execution: - `curl -fsSL https://fdv.lol/cli.mjs | node - run-profile --profile-url ./profile.json --log-to-console` Alternate fetch (directly from GitHub): - `curl -fsSL https://raw.githubusercontent.com/build23w/fdv.lol/main/cli.mjs | node - run-profile --profile-url ./profile.json --log-to-console` ``` ### Technical Analysis The documented commands pipe JavaScript obtained from an external network location directly into Node.js. Neither source is pinned to a reviewed release or immutable commit, and the instructions do not require verification of a cryptographic digest or signature. The primary source is controlled through the `fdv.lol` domain, while the alternate source follows the mutable `main` branch of a GitHub repository. Consequently, the effective code executed by the Skill may change after the Skill package has been reviewed. A compromise of the domain, hosting infrastructure, repository, maintainer account, DNS path, or release process could substitute arbitrary JavaScript. The retrieved process receives the path to `./profile.json`, which the preceding instruction explicitly describes as containing sensitive values. It executes with the same operating-system privileges as the Agent and is therefore technically capable of reading the profile, environment variables, wallet material, and other files available to that account. The Skill's textual instruction not to upload secrets cannot constrain the behavior of subsequently downloaded JavaScript. ### Attack Path 1. An attacker compromises the `fdv.lol` hosting e ...[truncated 1604 chars]
- Remediation
- ## Remediation Suggestions 1. Do not pipe network responses directly into Node.js or another interpreter. 2. Bundle the reviewed CLI implementation in the Skill package whenever licensing and distribution constraints permit. 3. If remote retrieval is unavoidable, use an immutable, versioned release artifact rather than a mutable branch or unversioned URL. 4. Publish a trusted SHA-256 or stronger digest independently and verify the downloaded file before execution. Prefer signed releases with verification against a pinned maintainer key. 5. Abort execution if download, signature validation, digest validation, ownership validation, or version validation fails. 6. Review the exact pinned CLI version for secret handling, transaction construction, logging, telemetry, and network destinations. 7. Execute the CLI in a sandbox with a restrictive filesystem allowlist and network allowlist. 8. Isolate wallet signing behind a narrowly scoped signer that validates transaction destination, amount, slippage, and spending limits rather than exposing the raw private key. 9. Require explicit user confirmation for material transactions and impose hard balance, per-trade, and cumulative-loss limits that remote code cannot bypass.