T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/setup.sh:154- Finding
Unverified Remote Installer Execution in Setup Script
- Content
View full analysis
/dev/null; then MAESTRO_VERSION=$(maestro --version 2>&1 | head -1) echo "✅ Maestro found: $MAESTRO_VERSION" else echo "Installing Maestro CLI..." if [ -n "${JAVA_HOME:-}" ]; then export PATH="$JAVA_HOME/bin:$PATH" fi curl -Ls "https://get.maestro.mobile.dev" | bash echo "" export PATH="$HOME/.maestro/bin:$PATH" echo "✅ Maestro installed to ~/.maestro/bin" fi ``` ### Technical Analysis The setup script downloads a mutable response from `https://get.maestro.mobile.dev` and passes it directly to Bash. It does not pin a Maestro version, verify a cryptographic signature, validate a checksum, save the response for inspection, or constrain the downloaded program. TLS protects the connection in transit, but it does not protect against compromise of the publisher's infrastructure, DNS or account takeover, accidental replacement of the installer, or a future malicious modification at the same URL. The effective code executed by the Skill can therefore change after the packaged Skill has been reviewed. This behavior is not the minimum privilege or trust level necessary to install Maestro. A fixed release artifact can be downloaded and verified without granting a remote endpoint an unrestricted shell execution channel. ### Attack Path 1. An attacker compromises the remote installer endpoint, its publishing pipeline, or credentials controlling its content. 2. The attacker replaces the expected installer with arbitrary shell commands. 3. A user runs `scripts/setup.sh` while Maestro is not already available in `PATH`. 4. `curl` retrieves the attacker-controlled response. 5. The shell immediately interprets the response as Bash code w ...[truncated 916 chars]- Remediation
View remediation