T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:173
- Finding
- Mutable Remote Installer Executed Directly with Cross-Session Persistence## Vulnerability Details **File Location**: `SKILL.md`, line 13 and line 173 **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution, T06: System Persistence` **Risk Level**: Critical **Vulnerable code and related documentation:** ```markdown (setup: see the repo README; `install.sh` registers it as a LaunchAgent). ``` ```bash daemon: curl -fsSL https://raw.githubusercontent.com/leeguooooo/iphone-use/main/install.sh | sh ``` ### Technical Analysis The update instructions download `install.sh` from the mutable `main` branch of a personal GitHub repository and pipe the response directly into `sh`. The payload is neither version-pinned nor protected by a published checksum or cryptographic signature. It is also not saved for inspection before execution. Consequently, the effective code executed by this Skill can change after the reviewed Skill package has been published. Piping a network response directly to a shell creates an arbitrary-code-execution channel under the privileges of the user invoking the command. Compromise of the repository, maintainer account, release process, or network trust chain could replace the installer with malicious commands. The documentation further states that the installer registers the daemon as a macOS LaunchAgent, causing installed code to run across sessions. Installing or updating a persistent daemon is operationally related to providing the documented iPhone-control service, but direct execution of an unverified mutable script exceeds the minimum privilege and trust required to interact with the daemon's HTTP API. Persistence should be separately disclosed and approved, and installation should use a verifiable artifact. ### Attack Path 1. An attacker compromises the GitHub account, repository, branch, or another component capable of altering the content returned for `install.sh`. 2. The attacker modifies the remote installer to include arbitrary malicious shell commands wh ...[truncated 1650 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the direct `curl | sh` installation and update instruction. 2. Publish versioned release artifacts and reference an immutable release tag or commit rather than the mutable `main` branch. 3. Download the installer to a local file first so that its source and contents can be reviewed before execution. 4. Publish a SHA-256 checksum through a separately protected channel and verify it before running the installer. 5. Cryptographically sign release artifacts and verify the signature against a documented, trusted maintainer key. Prefer a signed and notarized macOS package. 6. Require explicit user confirmation before installing a LaunchAgent. Clearly document its label, executable path, configuration, permissions, startup behavior, logs, network listeners, and uninstall procedure. 7. Run the daemon with the least privileges necessary. Avoid administrator privileges, restrict filesystem access, bind locally by default, and protect the API with strong authentication. 8. Separate daemon installation from routine Skill use. The Skill should normally interact only with an already installed and explicitly configured HTTP service. 9. Pin updates to reviewed versions and provide rollback instructions rather than automatically following the repository's latest mutable state. 10. Review and audit `install.sh` and every executable it retrieves before recommending it to users.