T03 · Remote Payload Retrieval and Execution
Warning
- Location
- SKILL.md:17
- Finding
- Mutable Remote Binary Is Downloaded and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 17-30 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Medium ### Vulnerable Code ```yaml { "id": "get-latest-version", "kind": "script", "script": 'node -e "const https = require(''https''); https.get(''https://api.github.com/repos/basjoofan/core/releases/latest'', {headers: {''User-Agent'': ''node.js''}}, (res) => {let data = ''''; res.on(''data'', chunk => data += chunk); res.on(''end'', () => {const release = JSON.parse(data); const version = release.tag_name.replace(/^v/, ''''); console.log(version);})}).on(''error'', (err) => {console.error(''Error:'', err.message); process.exit(1);});"', "env": { "VERSION": "${VERSION}", "ARCH": "${process.arch === 'arm64' ? 'aarch64' : 'x86_64'}", "OS": "${process.platform === 'darwin' ? 'apple-darwin' : process.platform === 'win32' ? 'pc-windows-msvc.exe' : 'unknown-linux-gnu'}", }, }, { "id": "download", "kind": "download", "url": "https://github.com/basjoofan/core/releases/download/v${VERSION}/basjoofan-${VERSION}-${ARCH}-${OS}", "bins": ["basjoofan"], "label": "Install basjoofan v${VERSION}", }, ``` ### Technical Analysis The installation configuration queries the GitHub API for the latest release version and then downloads a platform-specific native executable from that release. The selected version is mutable because it is determined at installation time rather than pinned to a previously audited release. The downloaded executable is not validated using a cryptographic checksum, publisher signature, or trusted manifest. Consequently, the effective code executed by the Skill can change after the Skill itself has been reviewed. HTTPS protects the download in transit but does not protect against a compromised upstream repository, stolen release credentials, a malicious release uploaded by a maintainer, or an unauthorized replacement of a release artifact. The remote ...[truncated 1645 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin installation to a specific, reviewed release version rather than dynamically resolving `latest`. 2. Publish platform-specific SHA-256 or stronger cryptographic digests through a separately protected release manifest. 3. Verify the downloaded executable against the expected digest before marking it executable or invoking it, and fail closed on any mismatch. 4. Sign release artifacts with a verifiable publisher identity, such as Sigstore/cosign or another suitable code-signing mechanism, and validate that signature during installation. 5. Pin the trusted signing identity or public key so that a newly supplied key from the same release channel cannot silently authorize a malicious artifact. 6. Restrict installation and execution to a least-privileged account or sandbox with only the filesystem and network access required for API testing. 7. Document the exact upstream repository, pinned version, expected checksums, and signature verification procedure so that the installed artifact can be independently audited. 8. Establish a controlled update process in which new releases are reviewed and their pinned version and digest are deliberately updated in the Skill. ]]>