T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/bootstrap.ts:267- Finding
Unverified Remote Code Is Downloaded and Executed During Bootstrap
- Content
View full analysis
value.trim()) .filter(Boolean); const tarballName = lines[lines.length - 1]; const tarballPath = path.join(tmpDir, tarballName); const extractResult = runCommand('tar', ['-xzf', tarballPath, '-C', targetDir, '--strip-components=1']); if (!extractResult.ok) { return { ok: false, message: extractResult.stderr || extractResult.stdout || `tar extract failed for ${packageRef}`, }; } rmSync(tmpDir, { recursive: true, force: true }); return { ok: true, message: `downloaded via npm: ${packageRef}`, }; } function downloadViaGithub(skill: SkillCatalogEntry, targetDir: string): { ok: boolean; message: string } { if (!skill.repository.https) { return { ok: false, message: 'repository.https is missing', }; } const cloneResult = runCommand('git', ['clone', '--depth', '1', skill.repository.https, targetDir]); if (!cloneResult.ok) { return { ok: false, message: cloneResult.stderr || cloneResult.stdout || `git clone failed for ${skill.repository.https}`, }; } return { ok: true, message: `downloaded via github: ${skill.repository.https}`, }; } function installSkillDependencies(skillDir: str ...[truncated 2795 chars]- Remediation
View remediation