T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:95- Finding
Mutable third-party executable is installed and run with access to Codex authentication and unpublished content
- Content
View full analysis
&1) || { ``` `gen-illustration.sh:33-56` places the complete article into the instructions and sends it through the same executable: ```bash # Build instructions: read template + slot in article body INSTRUCTIONS=$(python3 -c " import sys template = open(sys.argv[1]).read() article = open(sys.argv[2]).read() print(template.replace('[文章内容]', article)) " "$TEMPLATE" "$ARTICLE_MD") GEN_PROMPT="根据 instructions 中的文章内容,生成一张扁平卡通风格的解释图。画幅比例由内容决定 (双行对照用 3:2 / 4:3, 单行流程用横长条, 层级深度用竖版), 选最易读的版本。把文章的核心层级 / 对比 / 递进结构可视化,让读者一眼看懂。中文标签必须准确无伪字。" OUT="${ARTICLE_DIR}/illustration.png" SIZE="${WECHAT_PUBLISH_IMAGE_SIZE:-1536x1024}" QUALITY="${WECHAT_PUBLISH_IMAGE_QUALITY:-high}" echo "calling gpt-image-2-skill (illustration, size: $SIZE, quality: $QUALITY)" >&2 cd "$HOME/.claude/skills/gpt-image-2-skill" # Codex-only: --instructions is supported solely by the codex provider, and we # do not allow OPENAI_API_KEY fallback. ~/.codex/auth.json must exist. RESULT=$(node "$W ...[truncated 2823 chars]- Remediation
View remediation
``` 2. Publish and verify a SHA-256 digest or cryptographic signature for the exact installed files before execution. 3. Prefer vendoring the minimal reviewed wrapper into this project so the audited package contains its complete executable behavior. 4. Review the wrapper and its transitive Node.js dependencies for credential handling, network destinations, subprocess execution, and arbitrary filesystem access. 5. Run image generation in a sandbox with access only to: - The necessary input prompt. - A dedicated output directory. - A short-lived provider token rather than persistent account credentials. 6. Remove unrelated environment variables before launching the wrapper and restrict outbound network access to documented provider endpoints. 7. Explicitly disclose that the full article is supplied to an external AI workflow, and obtain user confirmation before transmitting confidential or unpublished material. 8. Avoid recommending a moving repository head as an executable installation mechanism. ]]>