T08 · Insecure Dependencies
- Location
run.sh:29- Finding
Mutable, Unverified Remote Question-Bank Content
- Content
View full analysis
Vulnerability Details
File Location:
run.sh:29-43andrun.sh:73-85
Vulnerability Type: Unpinned remote content dependency
Risk Level: MediumComplete Code Snippet
bash # Question bank sources (priority: local > skill folder > GitHub fallback) KB_REPO="https://raw.githubusercontent.com/jrrqd/osnk-question-bank/master" get_kb_file() { local file="$1" # 1. Check workspace knowledge folder if [ -f "$KB_DIR/$file" ]; then cat "$KB_DIR/$file" # 2. Check skill folder (embedded) elif [ -f "$SCRIPT_DIR/$file" ]; then cat "$SCRIPT_DIR/$file" # 3. Fallback to GitHub else curl -s "$KB_REPO/$file" 2>/dev/null || echo "" fi }bash else if [ -f "$KB_DIR/osk-$year.md" ]; then shuf -n 1 "$KB_DIR/osk-$year.md" | head -15 elif [ -f "$SCRIPT_DIR/osk-$year.md" ]; then shuf -n 1 "$SCRIPT_DIR/osk-$year.md" | head -15 elif [ -f "$KB_DIR/osnk-$year.md" ]; then shuf -n 1 "$KB_DIR/osnk-$year.md" | head -15 elif [ -f "$SCRIPT_DIR/osnk-$year.md" ]; then shuf -n 1 "$SCRIPT_DIR/osnk-$year.md" | head -15 else curl -s "$KB_REPO/osk-$year.md" | head -15 || echo "Year $year not found" fi fiTechnical Analysis
When a requested local question-bank file is unavailable, the script retrieves Markdown from the
masterbranch of an external GitHub repository. The branch is mutable, and the response is not authenticated beyond ordinary TLS, pinned to a reviewed commit, or validated against an expected cryptographic digest.The downloaded content is not executed as shell code, so this is not remote code execution. However, it is subsequently displayed as question content. In an AI-agent environment, malicious Markdown could contain instruction-like text intended to influence the agent, making the untrusted content a potential indirect prompt-injection or output-m ...[truncated 1284 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the remote fallback and rely exclusively on the bundled, reviewable question bank.
- If remote updates are required, pin requests to an immutable reviewed Git commit rather than
master. - Maintain a SHA-256 allowlist for every remotely retrievable file and reject responses that fail verification.
- Use
curl --fail --show-error --locationwith explicit connection and overall timeouts. - Require explicit user consent before initiating network access.
- Treat downloaded Markdown strictly as untrusted data and clearly delimit it from agent instructions.
- Consider performing updates only through signed, versioned Skill releases instead of runtime retrieval.