T03 · Remote Payload Retrieval and Execution
Warning
- Location
scripts/x_hots:44- Finding
Mutable Remote Bootstrap Script Is Downloaded and Executed Without Integrity Verification
- Content
View full analysis
/dev/null 2>&1 && return 0 local gp="$VENV_DIR/get-pip.py" echo "[wrapper] ensurepip unavailable; fetching get-pip.py" >&2 if command -v curl >/dev/null 2>&1; then curl -fsSL https://bootstrap.pypa.io/get-pip.py -o "$gp" || return 1 elif command -v wget >/dev/null 2>&1; then wget -qO "$gp" https://bootstrap.pypa.io/get-pip.py || return 1 else "$VENV_PY" -c "import urllib.request; urllib.request.urlretrieve('https://bootstrap.pypa.io/get-pip.py', '$gp')" || return 1 fi "$VENV_PY" "$gp" >/dev/null 2>&1; local rc=$? rm -f "$gp" [ $rc -eq 0 ] } ``` ### Technical Analysis When `ensurepip` is unavailable, the launcher retrieves the current `get-pip.py` payload from an external URL and immediately executes it. Although the URL belongs to the official Python Packaging Authority bootstrap service and HTTPS provides transport protection, the script does not pin a specific artifact or verify a cryptographic hash or signature. Consequently, the effective executable payload can change after the Skill has been reviewed. The code that ultimately runs is not fully represented by the audited project contents. This is a supply-chain execution path rather than evidence that the current Skill intentionally exfiltrates data. ### Attack Path 1. The Skill runs on a system where the newly created virtual environment lacks a working `ensurepip`. 2. `bootstrap_pip` downloads the current `get-pip.py` from the remote bootstrap service. 3. The launcher performs no expected-hash or signature verification. 4. A compromised upstream artifact, distribution system, or trusted endpoint supplies modified Python code. 5. The launcher executes the downloaded payload using the virtu ...[truncated 558 chars]- Remediation
View remediation