T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:63
- Finding
- Mutable Remote Shell Script Downloaded and Executed Without Verification## Vulnerability Details **File Location**: `SKILL.md:63` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ```bash curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash ``` ### Technical Analysis The installation command retrieves a shell script from the mutable `main` branch of an external GitHub repository and pipes it directly to `bash`. The payload is neither included in the audited project nor pinned to an immutable commit or release. No checksum or cryptographic signature is verified before execution. As a result, the effective code executed by this Skill can change after the Skill has been reviewed. HTTPS protects data in transit but does not protect against compromise of the upstream repository, maintainer credentials, release process, or GitHub account. The pipe also prevents users from reviewing the complete downloaded artifact before it begins executing. Installing a CLI is necessary for the declared document-extraction workflow, but executing an unverified mutable script is not the minimum privilege or minimum trust mechanism required. A pinned and integrity-verified package or release artifact would provide the same functionality with substantially lower risk. ### Attack Path 1. An attacker compromises a maintainer account, repository token, GitHub organization, or another mechanism capable of modifying the upstream `main` branch. 2. The attacker modifies `scripts/adp-init.sh` to include malicious shell commands. 3. A user or AI Agent follows the installation instructions in `SKILL.md`. 4. `curl` retrieves the attacker-controlled version of the script. 5. The pipe sends the content directly to `bash` without inspection or integrity verification. 6. The payload executes with all permissions available to the invoking user. ### Impact Assessment A successful attack permits arbitrary command execution with the privilege ...[truncated 607 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the direct `curl | bash` installation method. 2. Pin the installer or binary to an immutable release version or Git commit rather than the mutable `main` branch. 3. Publish SHA-256 checksums for release artifacts and require verification before execution. 4. Prefer cryptographically signed releases and verify the signature against a documented vendor key. 5. Download the artifact to a local file first, inspect and verify it, and only then execute it explicitly. 6. Prefer a pinned package-manager installation, such as a reviewed npm package version, rather than an unconstrained latest release. 7. Run installation with an unprivileged account and avoid `sudo` unless a specific, documented operation requires elevation. 8. Document what files, directories, network endpoints, and environment settings the installer changes.