T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:622- Finding
Unverified Remote Installer Piped Directly into Bash
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:622-626
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Highbash **macOS / Linux / WSL**: ```bash curl -fsSL https://artifact.lx.netease.com/download/youdaonote-cli/install.sh | bash -s -- -f -b ~/.local/bin export PATH="$HOME/.local/bin:$PATH" # After execution, reply "installed"; the Agent will continue the original requesttext ### Technical Analysis The installation instructions pipe the response from a mutable external URL directly into Bash. This creates a remote code-execution channel in which the effective payload is determined at installation time rather than at Skill review time. HTTPS protects the connection in transit but does not establish that the returned script is the same artifact previously reviewed. The command does not pin a release, verify a checksum, validate a cryptographic signature, or save the script for mandatory inspection before execution. Compromise of the distribution server, DNS or certificate infrastructure, vendor publishing credentials, or the installer itself could therefore result in arbitrary commands being executed. The document states that the user must run the command manually and provides a safer download-and-review alternative elsewhere. These controls reduce automatic exploitation but do not eliminate the vulnerability because the direct execution command remains the primary macOS, Linux, and WSL installation example. Installing the required CLI under `~/.local/bin` is consistent with the Skill's declared functionality and avoids a system-wide installation. However, granting a mutable installer unrestricted shell execution is broader than the minimum privilege needed to place a verified CLI binary in that directory. ### Attack Path 1. The `youdaonote` CLI is absent or below the required version. 2. The Skill presents the installation instructions from `SKILL.md`. 3. The user ma ...[truncated 1399 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the direct
curl | bashinstallation command from the recommended workflow. - Publish versioned, immutable release artifacts for each supported platform.
- Require users to download a specific release rather than an unversioned installer endpoint.
- Publish SHA-256 checksums through an independently authenticated release channel and verify the downloaded artifact before execution.
- Prefer cryptographic signature verification using a pinned vendor signing key. A checksum hosted only beside a compromised artifact is insufficient against repository compromise.
- Install only the verified binary into
~/.local/bin; avoid granting a general-purpose installer script unrestricted shell execution. - If a script is unavoidable, download it to a new local file, verify its pinned digest or signature, display the resolved version and source, and require explicit user confirmation before executing it.
- Document the files and directories the installer will modify and ensure it does not require administrator privileges, alter shell startup files, or access unrelated credentials.
- Keep the existing manual-execution boundary, but make the verified workflow mandatory rather than presenting inspection as an optional alternative.
- Remove the direct