T03 · Remote Payload Retrieval and Execution
Error
- Location
- scripts/update.sh:2
- Finding
- Unattended Self-Update Retrieves and Activates Mutable Remote Code## Vulnerability Details **File Location**: `scripts/update.sh:2-5` **Supporting Locations**: `SKILL.md:155-156`, `references/self-update-lucid.md:3-12` **Vulnerability Type**: Unattended remote code update **Risk Level**: High ### Complete Code Snippet ```bash cd "$(dirname "$0")/.." git reset --hard HEAD 2>/dev/null git clean -fd 2>/dev/null git pull 2>/dev/null ``` The update is configured as a recurring job: ```markdown | `lucid:update` | cron | `0 0 * * *` (midnight daily) | `lucid.update` | ``` The documented update procedure explicitly retrieves the mutable `origin/main` branch: ```markdown 3. Fetch remote version via `git fetch origin` 4. Check `git log HEAD..origin/main --oneline` for incoming commits ... 7. `git pull origin main` ``` ### Technical Analysis Initialization registers a daily update task, and the update script performs an unrestricted `git pull` from the configured remote. The retrieved revision is not pinned to a previously approved commit, verified against a digest, or authenticated through a required trusted signature. There is also no staging and approval gate before the fetched files become the active Skill installation. This creates a post-review code execution channel: the effective contents of Skill instructions and scripts can change after the installed package has been audited. The attacker-controlled point is the mutable remote branch, under the control of the repository operator or an attacker who compromises that repository or its publishing credentials. The dangerous operation is not merely downloading data. The pull replaces active Skill files, which are subsequently interpreted or executed by scheduled and manual Skill invocations under the Agent's existing permissions. ### Attack Path 1. `lucid.init` registers the documented midnight `lucid:update` job. 2. The remote repository operator, or an attacker with control of the remote repository, adds malici ...[truncated 1058 chars]
- Remediation
- ## Remediation Suggestions 1. Disable unattended activation of remote updates. 2. Fetch updates into a separate staging directory or detached worktree. 3. Pin updates to an explicitly approved commit rather than following a mutable branch. 4. Require verification of a trusted commit or release signature. If signatures are unavailable, verify a digest delivered through an independently trusted channel. 5. Display the exact commit range and file diff, then require explicit user approval before activation. 6. Reject updates that modify unexpected files, introduce new executables, or alter scheduled-task definitions unless separately approved. 7. Activate an approved revision atomically and retain a known-good rollback copy. 8. Record the verified commit identifier and verification result in the update log.