T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:29- Finding
Mutable Remote Executable Installed into a System-Wide Binary Directory
- Content
View full analysis
and with your platform (linux/darwin, amd64/arm64) curl -fsSL https://github.com/electather/seer-cli/releases/latest/download/seer-cli___.tar.gz -o seer-cli.tar.gz curl -fsSL https://github.com/electather/seer-cli/releases/latest/download/seer-cli__checksums.txt -o checksums.txt grep seer-cli___.tar.gz checksums.txt | sha256sum -c tar -xzf seer-cli.tar.gz sudo mv seer-cli /usr/local/bin/ ``` ### Technical Analysis The installation procedure retrieves a precompiled executable from a personal GitHub repository and installs it in `/usr/local/bin`. The project being audited contains only documentation, so the source code and behavior of the downloaded executable cannot be reviewed from the supplied artifact. Although the archive is checked with SHA-256, the checksum file is downloaded from the same mutable GitHub release as the executable. This establishes integrity against accidental transfer corruption but does not authenticate the publisher or protect against compromise of the repository, release workflow, or maintainer account. An attacker capable of replacing the archive could also publish a matching checksum. Use of the mutable `releases/latest` path further allows the effective payload to change after this Skill has been reviewed. The `sudo mv` operation also exceeds the privileges necessary for a per-user CLI installation by writing the executable into a system-wide command directory. The displayed sequence is not a direct `curl | bash` pipeline. Nevertheless, it retrieves an externally controlled executable that users are subsequently instructed to invoke. ### Attack Path 1. An attacker compromises the maintainer's GitHub account, repository, release credentials, or ...[truncated 1488 chars]- Remediation
View remediation