T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/setup.sh:38- Finding
Unverified Remote Binary Download and Execution
- Content
View full analysis
/dev/null; then curl -fSL "$DOWNLOAD_URL" -o "$INSTALL_DIR/cortex" 2>/dev/null elif command -v wget &>/dev/null; then wget -q "$DOWNLOAD_URL" -O "$INSTALL_DIR/cortex" else echo "ERROR: Need curl or wget" >&2; exit 1 fi chmod +x "$INSTALL_DIR/cortex" # Verify VERSION="$("$INSTALL_DIR/cortex" version 2>/dev/null || echo "FAILED")" ``` ### Technical Analysis The setup script downloads a precompiled executable from a remote GitHub release, marks it executable, and immediately runs it. It does not verify a cryptographic checksum or a release signature. The default version selector is `latest`, which is a mutable reference. Consequently, the effective code executed by the Skill can change after the Skill package itself has been reviewed. The existing “Verify” step only checks whether the downloaded program can execute and return a version; it does not establish authenticity or integrity. HTTPS protects the transfer in transit but does not protect against compromise of the upstream repository, maintainer account, release workflow, or published release artifact. This behavior exceeds the minimum safe privilege necessary for installation because arbitrary remote code is trusted and executed without independent validation. ### Attack Path 1. An attacker compromises the upstream GitHub repository, maintainer credentials, release automation, or release art ...[truncated 1074 chars]- Remediation
View remediation