T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:33- Finding
Unverified Remote Installation Script Executed Through the Shell
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 33–39
Vulnerability Type: Remote payload retrieval and execution
Risk Level: CriticalVulnerable Code
markdown ## Step 0 — Bootstrap Before any other command, make sure the CLI is installed and authenticated: 1. If `higgsfield` is not on `$PATH`, install it: ```bash curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | shtext ### Technical Analysis The Skill directs the Agent to retrieve an installation script from an external URL and pass the response directly to `sh`. The URL references the mutable `main` branch rather than an immutable release or commit. The downloaded content is not protected by a pinned cryptographic checksum or signature and is not saved for inspection before execution. Consequently, the effective code executed by this Skill can change after the audited artifact has been reviewed. Compromise of the upstream repository, its maintainers, the referenced branch, or the delivery path could turn an ordinary media-generation request into arbitrary local code execution. The repository namespace appears consistent with the advertised Higgsfield vendor, but that does not establish the integrity or future contents of the remote script. The script itself is not part of the audited project, so its exact behavior cannot be verified from this artifact. Installing a CLI may support the declared media-generation functionality. However, automatically executing an unverified remote script before performing that function exceeds the minimum safe privilege and trust boundary necessary. A pinned and cryptographically verified installation mechanism would provide the same capability with lower risk. ### Attack Path 1. A user invokes the Skill for an ordinary image or video generation request. 2. The Agent checks whether `higgsfield` exists on `$PATH`. 3. If it is absent, the Agent retrieves `install.sh` from the mutable upstream `mai ...[truncated 1391 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the direct
curl | shbootstrap instruction. - Prefer a trusted package manager and pin the CLI to an explicit version.
- If a standalone installer is necessary, reference an immutable release artifact or commit rather than
main. - Publish and verify a cryptographic signature or trusted SHA-256 checksum before execution.
- Download the installer to a temporary file first, reject redirects to unexpected hosts, verify integrity, and inspect the file before running it.
- Require explicit user approval before installing software or executing an installer.
- Document the installer's expected filesystem changes, network destinations, credential handling, and rollback procedure.
- Run installation with the least-privileged account available and prohibit privilege elevation.
- Where supported, constrain the Skill to an allowlist of required
higgsfieldcommands instead of granting unrestricted Bash execution. - Fail safely when the CLI is absent by providing manual, version-pinned installation instructions rather than automatically executing remote code.
A safer conceptual workflow is:
bash VERSION="<approved-version>" INSTALLER="higgsfield-install-${VERSION}.sh" EXPECTED_SHA256="<checksum-published-through-a-trusted-channel>" curl --fail --silent --show-error --location \ --output "$INSTALLER" \ "https://github.com/higgsfield-ai/cli/releases/download/${VERSION}/install.sh" printf '%s %s\n' "$EXPECTED_SHA256" "$INSTALLER" | sha256sum --check -- less "$INSTALLER" sh "$INSTALLER"The concrete release URL and checksum must come from an authenticated, trusted release process; placeholders must not be used operationally.
- Remove the direct