T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:58
- Finding
- Remote Foundry Installer Is Downloaded and Executed Without Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:58` **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: Critical ### Vulnerable Code ```bash - **Foundry** (forge, anvil, cast) - `curl -L https://foundry.paradigm.xyz | bash && foundryup` ``` ### Technical Analysis The installation instruction pipes the response from a mutable external URL directly into Bash. The remote content is executed before the user can inspect it, and the instruction provides no release pinning, checksum validation, signature verification, or other integrity control. The `-L` option follows HTTP redirects, meaning the final payload may be served from a different location than the visible URL. Even if the named Foundry domain is legitimate at the time of review, the effective executable content remains outside this package and can change after the skill has been audited. This behavior is not necessary to provide Cannon documentation or deployment assistance. Foundry can instead be installed from a pinned release using a separately downloaded and cryptographically verified artifact. ### Attack Path 1. A user or AI agent follows the prerequisite instruction in `SKILL.md`. 2. The external host, its delivery infrastructure, DNS resolution, or a redirect destination is compromised or begins serving modified content. 3. `curl` downloads the attacker-controlled response. 4. The shell pipeline sends the response directly to Bash without review or integrity verification. 5. The payload executes with the privileges of the user running the command. 6. The payload can inspect or modify accessible files, environment variables, wallet configuration, source code, and local agent data. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. The resulting scope includes all files and secrets readable by that account and all operations it is authorized to perform. In an Ethereu ...[truncated 416 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | bash` pipeline. 2. Pin Foundry to a specific reviewed release rather than installing the latest mutable version. 3. Download the installer or release artifact as a separate file. 4. Verify it against a checksum or cryptographic signature published through an independent trusted channel. 5. Display or inspect shell installers before execution. 6. Execute installation with an unprivileged account and only the filesystem permissions it requires. 7. Document the expected download URL, version, checksum, signer identity, and verification commands. 8. Prefer a trusted package manager or official signed release artifacts where available. A safer workflow should follow this pattern: ```bash # Download a specifically pinned release artifact. # Verify its published checksum or signature. # Install it only after verification succeeds. ``` ]]>