T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:39
- Finding
- Unverified Remote Payload Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 39–48 **Vulnerability Type**: Remote payload retrieval and execution without artifact verification **Risk Level**: High ### Vulnerable Code Snippet ```markdown The CLI binary is not included in the Skill package. It is downloaded from the **official ComPDFKit distribution server** (`download.compdf.com`) operated by PDF Technologies, Inc. The Agent must complete the following steps before the first execution: 1. Check whether `<CLI>` exists → skip if it does 2. **Inform the user** that the CLI binary will be downloaded from `download.compdf.com` (official ComPDFKit CDN) 3. Download the appropriate archive for the platform: - **[Windows]**: `https://download.compdf.com/skills/winCLI/win.zip` - **[Mac]**: `https://download.compdf.com/skills/macCLI/mac.zip` 4. Extract the archive to the `{skill_root}/scripts/` directory (the zip already contains a `win/` or `mac/` prefix, so the correct directory structure is formed automatically after extraction) 5. **[Mac]** After extraction, run: `chmod +x {skill_root}/scripts/mac/compdf_cli` 6. Verify: run `<CLI> --help` to confirm the binary is executable ``` ### Technical Analysis The audited package does not contain the CLI implementation. Instead, the Skill instructs the Agent to retrieve an executable archive from mutable external URLs, extract it, grant execution permission on macOS, and execute the resulting binary. No immutable version, expected cryptographic hash, digital-signature verification procedure, trusted signing identity, or archive-content validation is specified. Running `<CLI> --help` only confirms that the downloaded file can execute; it does not establish its authenticity or integrity. HTTPS protects data in transit under ordinary conditions but does not protect against compromise of the vendor infrastructure, CDN, signing account, or mutable artifact at the source. Because the effective executable payload is obtained after the Sk ...[truncated 1877 chars]
- Remediation
- ## Remediation Suggestions 1. Distribute the CLI with the reviewed package where licensing permits, or use immutable, explicitly versioned artifact URLs. 2. Publish a trusted SHA-256 or stronger digest for every supported platform artifact and require verification before extraction or execution. 3. Digitally sign the binaries and archives. Verify the signature against a pinned vendor signing identity rather than merely checking that a signature exists. 4. Fail closed if the digest, signature, signer identity, platform, architecture, or expected filename does not match. 5. Validate the ZIP manifest before extraction: - Reject absolute paths and `..` path traversal. - Reject symbolic links and unexpected file types. - Permit only documented paths and filenames. - Enforce reasonable extracted-file count and size limits. 6. Extract into a newly created restricted directory first, validate all contents, and only then move the verified files into the Skill directory. 7. Present the exact artifact version, URL, digest, and signer to the user before download and obtain explicit approval before first execution. 8. Run the CLI with least privilege in an operating-system sandbox, restricting filesystem and network access to only the required input and output locations. 9. Treat `<CLI> --help` strictly as a functional check, not a security verification mechanism. 10. Provide source code or independently reproducible builds where feasible so the downloaded executable can be compared with the reviewed implementation.