T03 · Remote Payload Retrieval and Execution
Error
- Location
- data/install.md:104
- Finding
- Unpinned Remote Installation Script Executed Directly by a Shell## Vulnerability Details **File Location**: `data/install.md`, lines 25 and 104 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High The unsafe command is declared in the installation metadata at line 25 and presented as an executable installation option at line 104. **Complete vulnerable code snippet (line 25):** ```yaml - name: install-script-auto command: "curl -fsSL https://get.x-cmd.com | sh" verification: checksum risk_level: high recommendation: "avoid in sensitive environments" requires_review: false warning: "Executes remote code without manual review" ``` **Complete vulnerable installation command (line 104):** ```bash curl -fsSL https://get.x-cmd.com | sh ``` ### Technical Analysis The command downloads mutable content from `https://get.x-cmd.com` and immediately passes it to `sh`. The downloaded installer is not version-pinned, inspected, or cryptographically authenticated before execution. Consequently, the effective code can change after this Skill has been reviewed. HTTPS protects the connection in transit but does not establish that the returned script is a specific, audited release. Compromise of the hosting endpoint, deployment pipeline, domain, TLS credentials, or another trusted infrastructure component could cause arbitrary attacker-controlled shell commands to be returned and executed. The document explicitly warns that this option is high risk and recommends Homebrew or manual review. These warnings reduce the likelihood of accidental use but do not remove the execution vulnerability. The stated verification of downloaded binaries also occurs after the initial remote script has already started executing and therefore cannot protect against malicious commands embedded in that initial script. The declared purpose of the Skill is to manage package-manager mirror configuration. Executing an unrestricted external installer is not the minimum priv ...[truncated 1747 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `curl -fsSL https://get.x-cmd.com | sh` auto-install option from both the metadata and user-facing instructions. 2. Prefer a trusted package-manager installation using a version-pinned release where the package manager verifies package integrity and provenance. 3. If a standalone installer must remain available: - Download it to a uniquely created local file rather than piping it to a shell. - Pin the installer to an immutable release version and URL. - Publish a SHA-256 digest or, preferably, a cryptographic signature through an independently authenticated channel. - Verify the digest or signature before executing the installer. - Abort installation on any verification failure. - Allow the user to inspect the verified script before execution. 4. Require explicit user consent before downloading or executing installation code. Agents should not automatically select an installation method. 5. Run the installer as an unprivileged user in a restricted environment with no sensitive credentials. Do not request `sudo` unless a separately reviewed operation strictly requires it. 6. Document all files, network destinations, and shell-profile changes performed by the installer. 7. Treat the current manual-review workflow as an improvement over direct piping, but add cryptographic verification before execution; visual review alone is not a reliable integrity mechanism. A safer pattern is: ```bash umask 077 installer="$(mktemp)" curl -fL "https://example.invalid/releases/x-cmd-VERSION/install.sh" -o "$installer" printf '%s %s\n' 'PINNED_SHA256_VALUE' "$installer" | sha256sum -c - less "$installer" sh "$installer" rm -f "$installer" ``` The release URL and digest must be replaced with immutable, publisher-authenticated values.