T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/install_skill.sh:177- Finding
Untrusted remote Skill content is installed without integrity or trust validation
- Content
View full analysis
/dev/null || mktemp -d -t skill 2>/dev/null) trap 'rm -rf "$tmpdir"' EXIT # 下载（支持 zip 和 直接文件） if curl -sL --connect-timeout 10 -o "$tmpdir/skill.zip" "$url" 2>/dev/null || \ wget -qO "$tmpdir/skill.zip" --timeout=10 "$url" 2>/dev/null; then # 如果是 zip 文件 if file "$tmpdir/skill.zip" | grep -qi "zip"; then unzip -qo "$tmpdir/skill.zip" -d "$tmpdir/extracted" 2>/dev/null || true ensure_dir cp -r "$tmpdir/extracted"/* "$TARGET_DIR/" 2>/dev/null || true output_result true "Skill '$CONFIG_NAME' 已从 URL 安装" else # 可能是单个 SKILL.md ensure_dir cp "$tmpdir/skill.zip" "$TARGET_DIR/SKILL.md" 2>/dev/null || true output_result true "Skill '$CONFIG_NAME' SKILL.md 已从 URL 下载" fi else output_result false "从 URL 下载失败" "请确认 URL 可访问，或使用 --create 模式创建" fi } ``` ### Technical Analysis The installer accepts an arbitrary URL and copies the response directly into an active CodeBuddy Skill directory. It does not enforce a trusted-domain policy, verify a digital signature or pinned digest, inspect downloaded Skill instructions or scripts, or require a security review before activation. A downloaded `SKILL.md` may contain attacker-controlled instructions that influence the Agent when the Skill is loaded. A downloaded archive may also contain executable scripts that become available to later Skill workflows. Redirects are followed with `curl -L`, so even an initially trusted URL may redirect to an untrusted host. The archive extraction path is also not prevalidated for unexpected file types, symlinks, or unsafe entries before its contents are copied into the destination. ### Attack Path 1. An ...[truncated 950 chars]- Remediation
View remediation