T03 · Remote Payload Retrieval and Execution
Error
- Location
kagi-fastgpt.sh:43- Finding
Unverified Remote Binary Download and Execution
- Content
View full analysis
/dev/null 2>&1; then RELEASE_META="$(curl -fsSL "https://api.github.com/repos/joelazar/kagi-skills/releases/latest")" elif command -v wget >/dev/null 2>&1; then RELEASE_META="$(wget -qO- "https://api.github.com/repos/joelazar/kagi-skills/releases/latest")" else echo "Error: Neither curl nor wget found. Please download the binary manually from:" >&2 echo " https://github.com/joelazar/kagi-skills/releases/latest" >&2 exit 1 fi TAG="$(printf '%s\n' "$RELEASE_META" | grep -m1 '"tag_name"' | cut -d'"' -f4 || true)" if [[ -z "$TAG" ]]; then echo "Error: Could not resolve latest release tag from GitHub API." >&2 echo "Please download manually from: https://github.com/joelazar/kagi-skills/releases/latest" >&2 exit 1 fi BINARY="kagi-fastgpt_${TAG}_${OS}_${ARCH}" URL="https://github.com/joelazar/kagi-skills/releases/download/${TAG}/${BINARY}" echo "kagi-fastgpt binary not found. Download pre-built binary from GitHub releases?" >&2 echo " $URL" >&2 read -r -p "Download? [Y/n] " reply >&2 &2 echo " $URL" >&2 exit 1 ;; esac if command -v curl >/dev/null 2>&1; then curl -fsSL "$URL" -o "$BIN" else wget -qO "$BIN" "$URL" fi chmod +x "$BIN" fi fi exec "$BIN" "$@" ``` ### Technical Analysis When a suitable Go compiler or an existing executable is unavailable, the wrapper queries the mutable GitHub `latest` release endpoint, downloads the corresponding executable, grants it execution permission, and subsequently executes it. The downloaded artif ...[truncated 2544 chars]- Remediation
View remediation