T03 · Remote Payload Retrieval and Execution
- Location
SKILL.md:34- Finding
Externally Hosted CLI Is Installed and Executed Without Immutable Integrity Verification
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:34-39
Vulnerability Type: Remote payload retrieval and execution without immutable verification
Risk Level: HighVulnerable Code:
markdown ## Install the CLI If `smfa` is not already available, install the immutable public release. Copy and run exactly this command; do not substitute a PyPI package spec, branch, or other source: ```bash uv tool install git+https://github.com/dvlin-dev/social-media-favorites-archiver.git@v1.0.4text ### Technical Analysis The Skill instructs the Agent to retrieve and install executable code directly from an external Git repository. Although the Git reference uses a version tag rather than a moving branch, a tag is not an immutable cryptographic identity and can potentially be moved or replaced by an upstream maintainer or an attacker who compromises the repository. The audited project contains documentation only and does not include the installed application's source code. It also provides no full commit SHA, artifact digest, signature, trusted release manifest, or reproducible-build verification procedure. Consequently, the effective executable payload is outside the audited bundle and may differ between the time of review and installation. The statement that this is an “immutable public release” is therefore not technically enforced by the installation command. The security properties documented elsewhere in the Skill—such as sanitized logging, constrained browser access, safe cleanup, and restricted enrichment—cannot be independently verified against the remotely retrieved implementation. ### Attack Path 1. An attacker compromises the upstream GitHub repository, an authorized maintainer account, or the release-tag management process. 2. The attacker moves or recreates the `v1.0.4` tag so that it resolves to a malicious commit. 3. A user or Agent follows the Skill instructions and runs: `uv tool install ...[truncated 1472 chars]- Remediation
View remediation
Remediation Suggestions
-
Pin the dependency to a full, reviewed Git commit SHA instead of a mutable tag:
bash uv tool install git+https://github.com/dvlin-dev/social-media-favorites-archiver.git@FULL_REVIEWED_COMMIT_SHA -
Prefer a versioned release artifact with a published SHA-256 or stronger digest. Require users or the installer to verify the digest before installation.
-
Sign release artifacts and provenance metadata using a verifiable mechanism such as Sigstore, and document mandatory signature verification steps.
-
Include the executable application's source in the audited bundle, or provide a direct reference to the exact reviewed commit and a reproducible-build process that proves the installed artifact corresponds to that source.
-
Fail closed if integrity verification cannot be completed. Do not silently fall back to a branch, unpinned package version, alternate repository, or unsigned artifact.
-
Run the CLI with least privilege and isolate it from unrelated files and credentials. Limit the dedicated browser profile, vault, state database, and cache permissions to the minimum required paths.
-
Keep optional enrichment credentials out of the environment unless enrichment is actively requested, thereby reducing the impact of a compromised installation.
-