T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:16
- Finding
- Mutable Remote Installer Is Piped Directly into a Shell## Vulnerability Details **File Location**: `SKILL.md`, line 16 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High **Vulnerable Code**: ```bash curl -LsSf https://astral.sh/uv/install.sh | sh ``` ### Technical Analysis The installation instructions retrieve a mutable shell script from an external URL and pipe its contents directly into `sh`. The script is executed before the user or agent can inspect it, and the command provides no version pinning, cryptographic signature verification, or checksum validation. HTTPS authenticates the server connection under ordinary conditions but does not establish that the script is immutable or safe. The effective payload can change after this Skill has been reviewed. Compromise of the hosting domain, its deployment infrastructure, DNS or certificate ecosystem, or the upstream installer could therefore turn this documented prerequisite step into arbitrary code execution. This behavior exceeds the minimum privileges necessary for the declared anime search and download functionality. The Skill only needs an available package runner; it does not inherently need permission to retrieve and execute an unrestricted installation script. The apparent use of Astral's documented domain reduces the likelihood of abuse but does not remove the remote execution risk. ### Attack Path 1. A user asks the agent to search for or download anime content. 2. The agent follows `SKILL.md` and checks whether `uvx` is installed. 3. If `uvx` is unavailable, the agent executes the documented `curl | sh` command. 4. The response from `https://astral.sh/uv/install.sh` is sent directly to the shell without local review or integrity validation. 5. If the remote delivery source or installer has been compromised, attacker-controlled shell commands execute with the privileges of the user running the agent. 6. Those commands could access user-readable files, modify shell config ...[truncated 741 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `curl | sh` instruction and treat `uv` or `uvx` as an explicit prerequisite that users install separately through a trusted system package manager. 2. If automated installation is required, pin an audited release rather than retrieving a mutable installer endpoint. 3. Download the installer or release artifact to a local file without executing it immediately. 4. Verify a publisher-provided cryptographic signature or a trusted, version-specific SHA-256 checksum before execution. 5. Allow the user to inspect and explicitly approve the downloaded artifact. 6. Run installation with ordinary user privileges and do not recommend `sudo` unless a separately justified operation requires it. 7. Document the exact files and directories the installation is expected to modify.