T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:55
- Finding
- Unverified Remote Shell Script Retrieved from a Mutable Branch and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 55–74 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash # Download the release script curl -o publish.sh https://raw.githubusercontent.com/lvtong199881/MyRNApp/refs/heads/main/publish.sh chmod +x publish.sh # Add npm scripts (optional) npm pkg set scripts.release="bash publish.sh" npm pkg set scripts.debug="bash publish.sh debug" ``` The downloaded script is subsequently executed as follows: ```bash # Publish a release version npm run release # Or execute directly ./publish.sh # Publish a debug version npm run debug # Or execute directly ./publish.sh debug ``` ### Technical Analysis The Skill instructs users to retrieve a shell script from a personal GitHub repository's mutable `main` branch and execute it locally. The remote resource is not pinned to an immutable commit, and no cryptographic checksum, digital signature, or trusted release artifact verification is performed. Consequently, the code reviewed during this audit is not necessarily the code that a future user will execute. The repository owner—or an attacker who compromises the repository, GitHub account, branch, or delivery path—can replace `publish.sh` after the Skill has been reviewed. The remote script is not included in the audited project, so its implementation and effective permissions cannot be verified. According to the documented workflow, it operates in a React Native repository and may have access to: - The user's source code and working tree. - Local Git credentials and repository remotes. - The GitHub token stored at `~/.github_token`. - Package files, generated bundles, changelogs, commits, and tags. - Network access used to push changes and create GitHub releases. Downloading arbitrary executable code from a mutable personal repository exceeds the minimum privilege and trust required for the declared release workflow. A reviewed script bundle ...[truncated 1785 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Include the complete, reviewed `publish.sh` implementation inside the Skill package rather than downloading executable code at runtime. 2. If remote retrieval is unavoidable, pin the URL to a specific immutable Git commit instead of `refs/heads/main`. 3. Publish and document a trusted SHA-256 digest, then verify it before execution and fail closed on any mismatch. For example: ```bash curl --fail --show-error --location \ --output publish.sh \ "https://raw.githubusercontent.com/lvtong199881/MyRNApp/<immutable-commit>/publish.sh" echo "<trusted-sha256> publish.sh" | sha256sum --check - bash publish.sh ``` 4. Prefer signed release artifacts and verify the maintainer's cryptographic signature against a separately established trusted key. 5. Review the script locally before execution and expose its source as part of the audited Skill. 6. Use a fine-grained GitHub token restricted to the specific target repository and only the permissions needed to create releases and upload assets. 7. Avoid broadly scoped classic Personal Access Tokens. Use short-lived credentials where supported and revoke or rotate them after suspected exposure. 8. Prevent the release script from reading unrelated files or credentials, and run it in an isolated CI job or restricted container with access only to the required project files. 9. Configure branch protection, mandatory review, signed commits, and restricted write access for the repository hosting any release automation. ]]>