T03 · Remote Payload Retrieval and Execution
Error
- Location
- references/self-update-sands.md:1
- Finding
- Unattended Self-Update Installs Mutable Remote Code## Vulnerability Details **File Location**: `references/self-update-sands.md:1-15` **Vulnerability Type**: Mutable remote payload retrieval and installation **Risk Level**: High ### Complete Vulnerable Snippet ```markdown # Sands — Self-Update Procedure `sands.update` pulls the latest package from GitHub. Runs silently. 1. Read `source:` from frontmatter → extract `{owner}/{repo}` from URL 2. Read local version from frontmatter `metadata.version` 3. Fetch remote version: `gh api "repos/{owner}/{repo}/contents/SKILL.md" --jq '.content' | base64 -d | grep 'version:' | head -1` 4. If remote equals local → stop silently 5. Download and install: ```bash TMPDIR=$(mktemp -d) gh api "repos/{owner}/{repo}/tarball/main" > "$TMPDIR/archive.tar.gz" mkdir "$TMPDIR/extracted" tar xzf "$TMPDIR/archive.tar.gz" -C "$TMPDIR/extracted" --strip-components=1 cp -R "$TMPDIR/extracted/"* ./ rm -rf "$TMPDIR" ``` ``` The related local updater in `scripts/update.sh:1-5` is: ```bash #!/bin/bash cd "$(dirname "$0")/.." git reset --hard HEAD 2>/dev/null git clean -fd 2>/dev/null git pull 2>/dev/null ``` The update is registered as a daily background task by `SKILL.md:152-168`: ```markdown - [ ] Register cron jobs listed below if not already present (check the platform scheduling registry first) | Job name | Schedule | Command | Purpose | |---|---|---|---| ... | `sands:update` | `0 0 * * *` | `sands.update` | Self-update from GitHub source | All cron jobs use: `--session isolated --light-context --tz America/Los_Angeles`. ``` ### Technical Analysis The Skill establishes an unattended update channel that retrieves an archive from the mutable `main` branch and copies its contents directly over the active installation. No immutable commit pin, trusted signature, expected digest, content allowlist, review gate, or per-update approval is required. The separate shell updater likew ...[truncated 1852 chars]
- Remediation
- ## Remediation Suggestions 1. Remove unattended installation of updates, especially the daily scheduled self-update. 2. Require explicit user approval before downloading and activating each update. 3. Resolve updates to an immutable commit or versioned release rather than a mutable branch. 4. Verify a trusted cryptographic signature or an independently supplied expected digest before extraction. 5. Download and extract into a staging directory, reject links and unexpected file types, and validate the complete manifest before installation. 6. Present the source revision and file diff for review before replacing active files. 7. Activate a validated update atomically and retain a known-good rollback copy. 8. Avoid `git reset --hard` and `git clean -fd` in the update path because they silently discard local state and can conceal the extent of remote replacement. 9. Ensure scheduled tasks never execute newly downloaded code until the same approval and verification controls have completed.