T03 · Remote Payload Retrieval and Execution
- Location
SKILL.md:14- Finding
Installation and Execution of an Unverified External Backend
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 14–17
Vulnerability Type: Remote payload retrieval and insecure dependency installation
Risk Level: Highmarkdown > **Server code and download:** > - Repository: https://github.com/DamianLeeMoha/local_hub > - Direct ZIP: https://github.com/DamianLeeMoha/local_hub/releases/download/v1.0.0/local_hub-v1.0.0.zip > Extract the archive, create a virtual environment, install dependencies > (`python3 -m venv .venv-hub`, `source .venv-hub/bin/activate`, > `pip install -r requirements.txt`), and then execute `./run.sh`.Technical Analysis
The Skill is documentation-only and does not include the backend source that implements its declared functionality. Instead, it directs the user to download a release archive from a personal GitHub repository, install the externally supplied Python dependency set, and execute an externally supplied startup script.
The instructions provide no cryptographic checksum, signature, verified immutable source commit, or hash-locked dependency manifest. Consequently, the behavior of
run.sh, the backend source, and packages referenced byrequirements.txtcannot be established from the audited artifact. A compromised maintainer account, replaced release asset, malicious repository change, or compromised dependency could therefore introduce code that was absent during Skill review.Installing the backend is necessary to provide the documented local capabilities, but trusting an unverified external payload is not the minimum-risk way to provide them. The trust exposure is particularly significant because the advertised backend handles microphones, cameras, clipboard contents, local file paths, system information, local AI services, and whitelisted script execution.
Attack Path
- An attacker compromises the external repository, its maintainer account, the release asset, or a dependency referenced by the external `requireme ...[truncated 1441 chars]
- Remediation
View remediation
Remediation Suggestions
- Include the complete backend source in the reviewed distribution, or pin the external source to a specific immutable commit.
- Publish a SHA-256 or stronger digest for the release archive and require users to verify it before extraction or execution.
- Cryptographically sign releases and document a trusted signature-verification procedure.
- Replace an unconstrained
requirements.txtworkflow with a reviewed lockfile containing exact versions and package hashes, such as hash-validated requirements used withpip --require-hashes. - Review installation scripts and prohibit dependency build hooks or packages from untrusted indexes where feasible.
- Run the service as a dedicated, unprivileged account or inside a sandbox with narrowly scoped filesystem, network, camera, microphone, and clipboard permissions.
- Disable sensitive capabilities by default and require explicit user authorization before activating device access, clipboard access, local-file processing, or script execution.
- Document and enforce loopback-only binding, endpoint authentication, request authorization, script allowlist validation, parameter validation, and request logging.
- Require explicit user confirmation before the agent invokes privacy-sensitive or command-execution endpoints.