T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/install-tools.sh:25- Finding
Mutable remote installer content is recommended for direct shell execution
- Content
View full analysis
/dev/null; then echo "✅ Forge already installed: $(forge --version 2>&1 | head -1)" else echo "⚠️ Forge not found. Install via: curl -L https://foundry.paradigm.xyz | bash && foundryup" fi ``` ```bash # --- Aderyn --- if command -v aderyn &>/dev/null; then echo "✅ Aderyn already installed: $(aderyn --version 2>&1 | head -1)" else echo "📦 Installing Aderyn..." if command -v cargo &>/dev/null; then cargo install aderyn elif [ -f "$HOME/.cargo/env" ]; then source "$HOME/.cargo/env" cargo install aderyn else echo "⚠️ Rust/cargo not found. Install Rust first:" echo " curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y" echo " source ~/.cargo/env && cargo install aderyn" fi fi ``` ### Technical Analysis The script does not automatically execute the two `curl | shell` pipelines; it prints them as installation instructions when Foundry or Rust is unavailable. Nevertheless, following those instructions passes mutable network responses directly to a command interpreter without first verifying a pinned version, cryptographic signature, or checksum. HTTPS protects the connection in transit but does not establish that the returned script is immutable or that a compromised upstream host cannot deliver a malicious response. The effective payload can change after the Skill package has been reviewed. The Foundry command also does not restrict the protocol and minimum TLS version as the Rust command does, although such restrictions would not eliminate the underlying pipe-to-shell risk. This behavior is not necessary for the Skill's core auditing function. Tools can be installed from pinned, indep ...[truncated 1281 chars]- Remediation
View remediation