T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:105
- Finding
- Unverified Remote Installer Is Executed Directly by the Shell## Vulnerability Details **File Location**: `SKILL.md`, line 105 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -LsSf https://astral.sh/uv/install.sh | sh ``` ### Technical Analysis The native installation instructions retrieve a shell script from an external URL and pipe the response directly into `sh`. The effective code is determined by the remote server at installation time rather than by the reviewed Skill package. HTTPS provides transport protection but does not establish that the returned script is the same version that was previously reviewed. The command does not pin an installer version or verify a cryptographic checksum or signature. A compromise of the upstream server, domain, distribution infrastructure, or publishing credentials could therefore replace the expected installer with arbitrary shell commands. This behavior exceeds the minimum privileges necessary to install the dependency because safer installation mechanisms can retrieve a fixed release and verify it before execution. ### Attack Path 1. An attacker compromises the installer host, its publishing credentials, or another part of its delivery infrastructure. 2. The attacker changes the response served from `https://astral.sh/uv/install.sh`. 3. A user follows the documented native installation procedure. 4. `curl` downloads the attacker-controlled response. 5. The pipeline passes that response immediately to `sh`, without inspection or integrity verification. 6. The payload executes with the privileges of the user running the installation command. ### Impact Assessment Successful exploitation permits arbitrary command execution under the invoking user's account. The resulting scope may include: - Reading or altering files accessible to that user. - Accessing locally available credentials, tokens, and development configuration. - Modifying source code, research data, generated results, or shell configuration. ...[truncated 382 chars]
- Remediation
- ## Remediation Suggestions - Remove the direct `curl | sh` pipeline from the installation instructions. - Prefer installation through a trusted package manager using a pinned package version. - If an installer artifact must be downloaded: 1. Use a version-specific, immutable release URL. 2. Download the artifact to a local file instead of piping it into a shell. 3. Verify a publisher-provided cryptographic signature or a checksum obtained through an independently trusted channel. 4. Inspect the downloaded script before execution. 5. Execute it as an unprivileged user and avoid unnecessary `sudo` use. - Pin repository revisions and container image digests in related setup instructions to reduce broader supply-chain exposure. - Document the files, network access, and permissions required by the installer so users can evaluate its scope before running it.