T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:15
- Finding
- Unpinned Remote Repository Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 15–18 **Vulnerability Type**: Mutable remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash git clone https://github.com/toverainc/willow-inference-server.git cd willow-inference-server ./utils.sh install ./utils.sh gen-cert your-hostname ./utils.sh run ``` ### Technical Analysis The documented setup clones the mutable default branch of an external GitHub repository and immediately executes scripts obtained from it. No reviewed release tag or immutable commit is pinned, and no checksum, signature, or other integrity verification is required before execution. Consequently, the code executed by users can differ from the code present when this skill was audited. An attacker who compromises the upstream repository, a maintainer account, or the relevant branch could modify `utils.sh` or files invoked by it. Users following the instructions would then execute the modified payload locally. This is best classified as remote payload retrieval and execution because the effective executable payload is hosted outside the reviewed skill package and can change after review. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or another mechanism capable of modifying its default branch. 2. The attacker inserts malicious commands into `utils.sh` or a component executed by that script. 3. A user follows the setup instructions and clones the current default branch without pinning a reviewed revision. 4. The user runs `./utils.sh install`, `./utils.sh gen-cert your-hostname`, or `./utils.sh run`. 5. The attacker-controlled commands execute with the privileges and environment of that user. ### Impact Assessment Successful exploitation could provide arbitrary command execution under the account running the setup commands. Depending on that account's permissions and whether the upstream installer requests or invokes elevated privile ...[truncated 474 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the repository to a reviewed release and immutable commit hash rather than relying on the mutable default branch. 2. Publish the expected commit hash and cryptographic checksum in the skill documentation. 3. Prefer signed release artifacts and require verification of the maintainer signature before execution. 4. Instruct users to inspect downloaded scripts before running them. 5. Avoid executing remote installation scripts with administrative privileges unless strictly required. 6. Document the minimum permissions needed by each setup operation. 7. Where feasible, vendor a reviewed installer in the skill package or use a reproducible, integrity-locked package mechanism. 8. Periodically review the pinned revision and update it through an explicit security review process. ]]>