T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/install.sh:5- Finding
Unpinned Remote Source Is Built and Subsequently Executed
- Content
View full analysis
/dev/null || true)" case "$origin_url" in "$REPO_URL"|"https://github.com/paoosi/tradingbot"|"git@github.com:paoosi/tradingbot.git") ;; *) fail "Target directory origin is not paoosi/tradingbot: ${origin_url:-not configured}" ;; esac if [[ -n "$(git -C "$TARGET_DIR" status --porcelain)" ]]; then fail "The target repository contains uncommitted changes" fi git -C "$TARGET_DIR" pull --ff-only elif [[ -e "$TARGET_DIR" ]]; then if [[ ! -d "$TARGET_DIR" || -n "$(find "$TARGET_DIR" -mindepth 1 -maxdepth 1 -print -quit 2>/dev/null)" ]]; then fail "The target path exists and is not an empty directory or target Git repository" fi git clone --depth 1 "$REPO_URL" "$TARGET_DIR" else git clone --depth 1 "$REPO_URL" "$TARGET_DIR" fi mkdir -p "$TARGET_DIR/bin" "$TARGET_DIR/data" "$TARGET_DIR/logs" ( cd "$TARGET_DIR/web" npm ci npm run build ) ( cd "$TARGET_DIR" go build -o bin/server ./cmd/server go build -o bin/worker-supervisor ./cmd/worker-supervisor go build -o bin/strategy-runner ./cmd/strategy-runner ) ``` The generated binary is subsequently executed by `scripts/run.sh`: ```bash exec "$TARGET_DIR/bin/server" ``` ### Technical Analysis The installation process clones or updates the current state of a remote Git branch without pinning it to a reviewed commit, signed tag, or release artifact. It also does not verify a cryptographic checksum or Git signature before building the downloaded content. The effective payload can therefore change after the Skill package itself has been audited. In add ...[truncated 1678 chars]- Remediation
View remediation