T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:42
- Finding
- Unverified Remote Installer Is Piped Directly into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:42-46`, `generate_readme_cn.py:79-83`, and `heartbeat_ollama_guard.py:597-604` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code `SKILL.md:42-46`: ```bash **Linux：** ```bash curl -fsSL https://ollama.com/install.sh | sh ``` ``` `generate_readme_cn.py:79-83`: ```python p2 = doc.add_paragraph(style="List Bullet") p2.add_run("Linux：").bold = True p2.add_run(" curl -fsSL https://ollama.com/install.sh | sh") ``` `heartbeat_ollama_guard.py:597-604`: ```python print(" 请先安装 Ollama：") print(" macOS: brew install ollama") print(" 或访问 https://ollama.com 下载") print(" Linux: curl -fsSL https://ollama.com/install.sh | sh") print() print(" 安装完成后，重新运行：") print(" python3 heartbeat_ollama_guard.py --setup") ``` ### Technical Analysis The recommended command downloads a mutable shell script from an external URL and immediately passes its contents to `sh`. It does not pin an immutable release, validate a cryptographic checksum or signature, save the script for inspection, or verify the effective payload before execution. The Python files do not automatically execute this command: `generate_readme_cn.py` embeds it in generated documentation, while `heartbeat_ollama_guard.py` prints it when Ollama is missing. Nevertheless, users are explicitly instructed to execute the command as part of the installation process. HTTPS protects the connection in transit but does not establish that future content returned by the URL is identical to the content reviewed during this audit. Compromise of the hosting service, its deployment process, DNS or certificate trust chain, or the installer itself could change the executed payload after publication. The destination is the official-looking Ollama domain and is relevant to the Skill's declared functionality. No unrelated remote destination was identified. However, direct remote-to-shell execu ...[truncated 1234 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` instruction from all documentation and generated output. 2. Prefer a signed, versioned operating-system package or an official package-manager workflow. 3. If a standalone installer is unavoidable: - Use an immutable, version-specific release URL. - Download the installer to a local file instead of piping it to a shell. - Verify a publisher-provided cryptographic signature or pinned SHA-256 digest. - Display the source and allow the user to inspect it before execution. - Execute it as a separate, explicit step. 4. Keep the installer unprivileged unless a specific installation action demonstrably requires elevation. 5. Ensure `SKILL.md`, `generate_readme_cn.py`, and the CLI fallback instructions all use the same hardened procedure. A safer pattern is: ```bash curl -fL -o ollama-install.sh '<version-pinned-release-url>' printf '%s %s\n' '<trusted-sha256>' 'ollama-install.sh' | sha256sum -c - less ollama-install.sh sh ollama-install.sh ``` The checksum must be obtained through a trusted, independently authenticated release channel rather than from the same mutable response as the installer. ]]>