T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:40
- Finding
- Unverified Remote Installer Is Piped Directly into Bash## Vulnerability Details **File Location**: `SKILL.md:40-42`; duplicated in `README.md:25-27` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable code in `SKILL.md`:** ```bash curl -fsSL https://vouch.directory/install.sh | bash ``` **Vulnerable code in `README.md`:** ```bash curl -fsSL https://vouch.directory/install.sh | bash vouch init ``` ### Technical Analysis The installation instructions download a mutable shell script from an external server and pass it directly to Bash. The effective code is determined by the remote server at execution time rather than by the audited project contents. No version pinning, cryptographic signature validation, checksum verification, local inspection step, or reproducible package source is provided. HTTPS protects the transport connection but does not protect users if the hosting server, DNS infrastructure, deployment pipeline, or publishing account is compromised. It also does not prevent the script from being replaced after this audit. The package does not include the installer or Vouch CLI implementation, so the commands executed by `install.sh` cannot be evaluated from the supplied artifact. Executing a remote installer is relevant to installing the documented CLI, but piping it directly into a privileged shell exceeds the minimum necessary installation workflow because safer download, verification, and review steps are available. ### Attack Path 1. An attacker compromises `vouch.directory`, its DNS or TLS deployment environment, the installer publishing pipeline, or an authorized maintainer account. 2. The attacker replaces `https://vouch.directory/install.sh` with a malicious shell payload. 3. A user or shell-capable agent follows the documented installation command. 4. `curl` retrieves the current attacker-controlled response and streams it directly into Bash. 5. Bash executes the payload without integrity verification ...[truncated 941 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all `curl | bash` installation instructions from both `SKILL.md` and `README.md`. 2. Publish immutable, versioned releases through a trusted package repository or release system. 3. Pin the installation instructions to an explicit version rather than a mutable `install.sh` endpoint. 4. Provide detached cryptographic signatures and SHA-256 checksums through an independently protected channel. 5. Require users to download the artifact first, verify its signature and checksum, and only then execute or install it. 6. Document the files, permissions, network destinations, and system changes made by the installer. 7. Avoid requiring root privileges. If elevated privileges are unavoidable for a specific installation step, isolate and document that step rather than running the entire installer with elevation. 8. Publish the installer and CLI source in the audited repository so reviewers can verify their behavior. 9. Prefer a hardened flow such as: ```bash curl -fLo vouch.tar.gz https://example.invalid/releases/v1.0.0/vouch.tar.gz echo '<published-sha256> vouch.tar.gz' | sha256sum --check - # Verify a detached signature, inspect the archive, then install locally. ```