T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:24
- Finding
- Mutable Remote Installer Is Piped Directly into a Shell## Vulnerability Details **File Location**: `SKILL.md`, lines 24–31 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable Code**: ```bash curl -fsSL https://raw.githubusercontent.com/hochej/confcli/main/install.sh | sh ``` ```bash curl -fsSL https://raw.githubusercontent.com/hochej/confcli/main/install.sh | VERSION=0.2.3 sh curl -fsSL https://raw.githubusercontent.com/hochej/confcli/main/install.sh | INSTALL_DIR=~/.bin sh ``` ### Technical Analysis These installation instructions retrieve `install.sh` from a personal GitHub repository and immediately pipe its contents into a shell. The script is fetched from the mutable `main` branch, so its effective behavior may change at any time after the Skill has been reviewed. The repository contains neither a local copy of the installer nor a checksum, digital signature, or other integrity-verification mechanism. Consequently, the executed payload cannot be assessed from the audited project. Setting `VERSION=0.2.3` does not resolve this issue: it may select a version of the program to install, but the installer itself is still downloaded from the mutable `main` branch and executed without verification. Piping a network response directly into `sh` also prevents meaningful inspection before execution. If the remote repository, maintainer account, delivery infrastructure, or installation script is compromised, arbitrary commands can execute with the privileges of the user or Agent running the installation. This behavior exceeds the minimum privileges required to document or operate a Confluence command-line client. Installation should be a separate, explicit, integrity-verified action rather than automatic execution of mutable third-party code. ### Attack Path 1. The Agent checks for `confcli` and determines that it is not installed. 2. Following `SKILL.md`, the Agent or user runs one of the documented `curl | sh` commands. 3. A ...[truncated 1375 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all instructions that pipe network responses directly into a shell. 2. Prefer a trusted package manager or a locally included and reviewable installer. 3. Pin the installer and binary to immutable release artifacts or commit identifiers rather than the mutable `main` branch. 4. Publish and verify cryptographic checksums or signatures before executing or installing downloaded content. 5. Use a staged process: download the artifact, verify its origin and integrity, inspect it where practical, and only then execute it after explicit user approval. 6. Document the precise files, directories, and permissions modified during installation. 7. Install into a minimally privileged user-owned directory and avoid requesting administrative privileges unless they are demonstrably required. 8. Treat installation as a separate user-approved operation; the Agent should not automatically install remote software merely because `confcli` is absent. 9. If a version selector is retained, pin and verify both the installer itself and the resulting executable, because setting `VERSION` alone does not authenticate either component.