T03 · Remote Payload Retrieval and Execution
Error
- Location
references/self-update-sands.md:1- Finding
Unattended Self-Update Installs Mutable Remote Code
- Content
View full analysis
Vulnerability Details
File Location:
references/self-update-sands.md:1-15
Vulnerability Type: Mutable remote payload retrieval and installation
Risk Level: HighComplete Vulnerable Snippet
markdown # Sands — Self-Update Procedure `sands.update` pulls the latest package from GitHub. Runs silently. 1. Read `source:` from frontmatter → extract `{owner}/{repo}` from URL 2. Read local version from frontmatter `metadata.version` 3. Fetch remote version: `gh api "repos/{owner}/{repo}/contents/SKILL.md" --jq '.content' | base64 -d | grep 'version:' | head -1` 4. If remote equals local → stop silently 5. Download and install: ```bash TMPDIR=$(mktemp -d) gh api "repos/{owner}/{repo}/tarball/main" > "$TMPDIR/archive.tar.gz" mkdir "$TMPDIR/extracted" tar xzf "$TMPDIR/archive.tar.gz" -C "$TMPDIR/extracted" --strip-components=1 cp -R "$TMPDIR/extracted/"* ./ rm -rf "$TMPDIR" ```The related local updater in
scripts/update.sh:1-5is:bash #!/bin/bash cd "$(dirname "$0")/.." git reset --hard HEAD 2>/dev/null git clean -fd 2>/dev/null git pull 2>/dev/nullThe update is registered as a daily background task by
SKILL.md:152-168:markdown - [ ] Register cron jobs listed below if not already present (check the platform scheduling registry first) | Job name | Schedule | Command | Purpose | |---|---|---|---| ... | `sands:update` | `0 0 * * *` | `sands.update` | Self-update from GitHub source | All cron jobs use: `--session isolated --light-context --tz America/Los_Angeles`.Technical Analysis
The Skill establishes an unattended update channel that retrieves an archive from the mutable
mainbranch and copies its contents directly over the active installation. No immutable commit pin, trusted signature, expected digest, content allowlist, review gate, or per-update approval is required.The separate shell updater likew ...[truncated 1852 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove unattended installation of updates, especially the daily scheduled self-update.
- Require explicit user approval before downloading and activating each update.
- Resolve updates to an immutable commit or versioned release rather than a mutable branch.
- Verify a trusted cryptographic signature or an independently supplied expected digest before extraction.
- Download and extract into a staging directory, reject links and unexpected file types, and validate the complete manifest before installation.
- Present the source revision and file diff for review before replacing active files.
- Activate a validated update atomically and retain a known-good rollback copy.
- Avoid
git reset --hardandgit clean -fdin the update path because they silently discard local state and can conceal the extent of remote replacement. - Ensure scheduled tasks never execute newly downloaded code until the same approval and verification controls have completed.