T03 · Remote Payload Retrieval and Execution
Error
- Location
- data/install.md:104
- Finding
- Unpinned Remote Installation Script Executed Directly by Shell## Vulnerability Details **File Location**: `data/install.md`, lines 25 and 104 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical The installation metadata and user-facing instructions both provide a command that downloads a mutable remote response and immediately executes it: ```yaml - name: install-script-auto command: "curl -fsSL https://get.x-cmd.com | sh" verification: checksum risk_level: high recommendation: "avoid in sensitive environments" requires_review: false warning: "Executes remote code without manual review" ``` ```bash curl -fsSL https://get.x-cmd.com | sh ``` ### Technical Analysis The response from `https://get.x-cmd.com` is passed directly to `sh` without first pinning a release, verifying the initial script against a trusted digest or signature, or giving the user an opportunity to inspect the exact payload being executed. The effective installer can therefore change after this Skill has been reviewed. Although the document warns users about the danger and states that downloaded binaries receive checksum verification, it also acknowledges that this verification occurs only after the initial installation script has started. A malicious bootstrap script would consequently execute before downstream integrity checks could provide protection. Installation of the complete x-cmd framework also exceeds the narrow functionality required to query RFC documents. The framework's loader is later sourced into the current shell using `. ~/.x-cmd.root/X`, extending trust in the remotely installed content to future Skill invocations. No administrative privilege is requested, but arbitrary execution under the current user account is still broader than the minimum access required for RFC retrieval. ### Attack Path 1. A user invokes the Skill to search for or read an RFC. 2. The required x-cmd framework is not present. 3. The user or agent follows the doc ...[truncated 1621 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `curl -fsSL https://get.x-cmd.com | sh` command from both installation metadata and user-facing instructions. 2. Prefer a version-pinned package distributed through a maintained package repository with cryptographic integrity verification. 3. If an installation script is unavoidable: - Download a fixed-version artifact without executing it. - Publish an expected SHA-256 digest or signature through a separately trusted channel. - Verify the artifact before any part of it is executed. - Require manual inspection and explicit approval. - Execute it only after successful verification. 4. Do not characterize downstream binary checksums as verification of the initial bootstrap script; verify the bootstrap independently. 5. Require explicit user authorization before installing software, modifying shell configuration, or sourcing newly installed code. 6. Prefer a narrowly scoped, auditable RFC client instead of installing and sourcing the broader x-cmd framework. 7. Pin installer and package versions so the reviewed artifact cannot silently change after audit. 8. In automated environments, use an isolated account or disposable container without secrets and restrict network, filesystem, and environment access during installation.