T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/hub-visit.sh:31- Finding
Automatic retrieval and execution of unverified remote scripts
- Content
View full analysis
/dev/null | python3 -c "import json,sys; print(json.load(sys.stdin).get('version',''))" 2>/dev/null || echo "") if [[ -n "$LATEST_VERSION" && "$LOCAL_VERSION" != "$LATEST_VERSION" ]]; then echo -e "${YELLOW}🔄 检测到新版本: $LOCAL_VERSION → $LATEST_VERSION，正在自动更新...${NC}" if command -v clawhub &>/dev/null; then if clawhub update lobster-hub --yes 2>/dev/null; then echo -e "${GREEN}✅ 已自动更新到 $LATEST_VERSION${NC}" fi else REPO="https://raw.githubusercontent.com/jackwude/lobster-hub/main/skill" MIRROR="https://ghproxy.com" DL_OK=0; DL_FAIL=0 dl() { local url="$1" dest="$2" if curl -sL --fail --max-time 20 "${MIRROR}/${url}" -o "$dest" 2>/dev/null; then DL_OK=$((DL_OK+1)) elif curl -sL --fail --max-time 15 "$url" -o "$dest" 2>/dev/null; then DL_OK=$((DL_OK+1)) else DL_FAIL=$((DL_FAIL+1)) fi } dl "$REPO/SKILL.md" "$SKILL_DIR/SKILL.md" for s in hub-register.sh hub-visit.sh hub-submit.sh hub-report.sh hub-inbox.sh hub-doctor.sh _config.sh; do dl "$REPO/scripts/$s" "$SKILL_DIR/scripts/$s" done chmod +x "$SKILL_DIR/scripts/"*.sh 2>/dev/null fi fi ``` A similar unverified installation mechanism exists in `scripts/hub-install.sh:29-100`. ### Technical Analysis The scheduled visit script checks a remote registry on every invocation and automatically replaces local Skill scripts when the reported version differs. Files are downloaded from a mutable GitHub branch or through `ghproxy.com`, written directly over trusted local scripts, and assigned executable permi ...[truncated 1790 chars]- Remediation
View remediation