T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:39
- Finding
- Unverified Remote Installer Is Piped Directly into Bash## Vulnerability Details **File Location**: `SKILL.md`, lines 39-42 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash **Via CDN (if npm is unavailable):** ```bash curl -fsSL https://s.dwimg.top/uimap-install/install.sh | bash ``` ``` ### Technical Analysis The installation command retrieves a mutable shell script from `https://s.dwimg.top/uimap-install/install.sh` and immediately pipes its contents to Bash. It does not pin a specific release, verify a cryptographic checksum or signature, save the script for inspection, or otherwise establish the integrity of the downloaded payload. The repository contains no copy of this installer, so its behavior cannot be reviewed as part of the Skill audit. The effective code may change after review without any modification to `SKILL.md`. The project contents also do not establish that `s.dwimg.top` is an authoritative or trusted distribution endpoint. Because Bash executes the response directly, compromise of the domain, hosting infrastructure, TLS termination, deployment credentials, or installer itself would provide a direct arbitrary-code execution path. The downloaded script receives all permissions available to the user running the command. This execution mechanism is not required for the Skill's declared purpose of returning website navigation instructions and exceeds the minimum privilege necessary for that functionality. ### Attack Path 1. An attacker compromises or gains control over the remote installer, its hosting infrastructure, or its publication process. 2. The attacker replaces the installer response with malicious shell commands. 3. A user follows the documented CDN installation instructions. 4. `curl` retrieves the attacker-controlled response. 5. The pipe sends the response directly to Bash without integrity verification or review. 6. Bash executes the payload with the invoking user's privileges. ### Impact Assessme ...[truncated 630 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `curl | bash` installation method. 2. Prefer a version-pinned package or a release artifact from an authenticated, project-controlled distribution channel. 3. If a shell installer is unavoidable, publish its source in the audited repository and tie it to a specific immutable release. 4. Download the installer to a local file instead of executing it from a pipe. 5. Publish a SHA-256 or stronger checksum through a separate trusted channel and require verification before execution. 6. Cryptographically sign releases and document signature verification using a pinned signing identity. 7. Instruct users to inspect the downloaded script before running it. 8. Ensure the installer operates without administrator privileges unless a specific operation demonstrably requires them.