T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:14
- Finding
- Installation of a Mutable, Unverified Remote Binary with Broad Data Access## Vulnerability Details **File Location**: `SKILL.md`, lines 14-15 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code Snippet ```markdown Download the latest `.mcpb` from [GitHub Releases](https://github.com/chrischall/apple-swift-mcp/releases) and double-click to install in Claude Desktop. First run prompts for TCC permissions (Calendar, Reminders, Contacts, full disk if reading `chat.db`). ``` ### Technical Analysis The installation instructions direct users to download and execute the mutable “latest” binary from an external GitHub Releases page. The instructions do not pin a specific release or provide a cryptographic checksum, trusted signing identity, or explicit signature-verification procedure. Consequently, the code ultimately executed can change after the skill package has been reviewed. The package contains only `SKILL.md`; it does not contain the binary or source implementation needed to verify that the downloaded artifact conforms to the documented behavior. The declared permission scope increases the severity of a supply-chain compromise. The downloaded component may receive access to Calendar, Reminders, Contacts, and other macOS applications, as well as Full Disk Access for direct access to `chat.db`. The documentation also states that the component handles Mail, Messages, Notes, and Photos. This finding does not establish that the referenced project or current release is malicious. The vulnerability is the trust placed in a mutable, externally hosted executable without artifact pinning or documented integrity verification. ### Attack Path 1. An attacker compromises the upstream repository, release account, CI/CD workflow, signing infrastructure, or hosted release artifact. 2. The attacker replaces or publishes a malicious `.mcpb` as the latest release. 3. A user follows `SKILL.md` and downloads the current artifact without checking a pinned digest or t ...[truncated 1161 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the mutable “latest release” instruction with a specific, reviewed release version. 2. Publish the expected SHA-256 digest for the `.mcpb` artifact and require users to verify it before installation. 3. Document how to verify the artifact's Apple code-signing identity and notarization status using tools such as `codesign` and `spctl`. 4. Publish reproducible build instructions and retain the complete reviewed source code alongside the skill. 5. Bind release artifacts to signed tags and protect the release workflow with least-privilege credentials, mandatory review, and provenance attestations. 6. Request TCC and Full Disk Access permissions only when an operation strictly requires them. Clearly explain why each permission is needed before prompting. 7. Separate high-risk capabilities, such as direct database access and message sending, so users can install or enable only the features they need. 8. Provide a revocation and incident-response procedure covering permission removal, binary removal, release-key compromise, and notification of affected users.