T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:22
- Finding
- Mutable Remote Repository Is Retrieved and Executed Without Integrity Pinning## Vulnerability Details **File Location**: `SKILL.md`, lines 22–27 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```bash # Quick start git clone https://github.com/Higangssh/ghostmeet.git cd ghostmeet cp .env.example .env # Edit .env: set GHOSTMEET_ANTHROPIC_KEY for AI summaries docker compose up -d ``` ### Technical Analysis The installation procedure clones the mutable default branch of an external GitHub repository and immediately launches the retrieved Docker Compose project. It does not pin a reviewed commit or signed release, verify a checksum or signature, pin container images by digest, or require inspection of the downloaded Compose and Docker configuration. Consequently, the payload that executes can change after this Skill has been reviewed. An attacker who compromises the upstream repository, its maintainer account, the default branch, or a referenced container image could alter the Compose configuration, Dockerfiles, images, entry points, mounts, environment handling, or startup commands. A user following the documented procedure would then execute that changed content. The external backend is not included in the audited artifact. Therefore, its exact container privileges, host mounts, network access, secret handling, authentication, and runtime behavior could not be verified. ### Attack Path 1. An attacker compromises the upstream GitHub repository, a maintainer account, the mutable default branch, or a container image referenced by the repository. 2. The attacker modifies the repository or image to include malicious startup commands or container configuration. 3. A user follows the Skill's quick-start instructions and runs `git clone` without selecting a known-good revision. 4. The user places `GHOSTMEET_ANTHROPIC_KEY` in the downloaded project's `.env` file as instructed. 5. The user runs `docker compose up -d`, causing the unverified r ...[truncated 1036 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the installation to a reviewed commit hash or cryptographically signed release rather than cloning the mutable default branch. 2. Pin every container image by immutable digest and avoid mutable tags such as `latest`. 3. Publish and verify checksums or signatures for release artifacts before execution. 4. Require users to inspect the Compose file, Dockerfiles, entry points, host mounts, exposed ports, Linux capabilities, restart policies, and Docker socket access before startup. 5. Run containers as non-root users with read-only filesystems where practical, drop unnecessary Linux capabilities, enable `no-new-privileges`, and avoid privileged mode and sensitive host mounts. 6. Provide secrets through a restricted secret-management mechanism rather than placing API keys in a broadly accessible project environment file. Ensure secret files have restrictive permissions and are not mounted into components that do not require them. 7. Restrict outbound network access to destinations required for the declared functionality and keep transcript submission explicitly user-triggered. 8. Document the exact audited repository revision and image digests in `SKILL.md`, together with a safe upgrade and re-verification process.