T03 · Remote Payload Retrieval and Execution
Error
- Location
- references/troubleshooting.md:5
- Finding
- Unverified Remote Installer Is Piped Directly into a Shell## Vulnerability Details **File Location**: `references/troubleshooting.md:5` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High **Vulnerable Code**: ```bash curl -LsSf https://astral.sh/uv/install.sh | sh ``` ### Technical Analysis The troubleshooting guide instructs the user or agent to retrieve a mutable script from an external URL and pipe the response directly into `sh`. The downloaded content is executed without being saved for inspection, pinned to a reviewed version, or validated using a checksum or cryptographic signature. HTTPS protects the connection in transit but does not ensure that the current server response is the same content that was reviewed when the Skill was published. A compromise of the hosting service, its deployment pipeline, domain, or TLS trust chain could turn this installation command into arbitrary code execution. Installing `uv` may support the Skill's workflow, but executing an unverified remote response is not the minimum privilege necessary to install that dependency. ### Attack Path 1. The agent attempts to use `uvx` and discovers that it is unavailable. 2. The agent follows the troubleshooting guide and runs the documented command. 3. `curl` retrieves the current content from the external endpoint. 4. The response is passed directly to `sh` without integrity verification or review. 5. If the endpoint or delivery chain is compromised, attacker-controlled shell commands execute under the invoking user's identity. ### Impact Assessment A malicious installer would execute with all privileges available to the invoking user. It could read or modify accessible workspace files, source code, shell configuration, credentials, and user-level application data. It could also install additional software or establish persistence where the user's permissions allow it. The command does not explicitly invoke `sudo`, so administrative privileges are no ...[truncated 122 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the direct `curl | sh` pipeline. 2. Prefer an official operating-system package manager or other trusted installation channel. 3. If a standalone installer is necessary: - Pin the installer or release to a reviewed version. - Download it to a local file rather than piping it into a shell. - Verify a publisher-provided cryptographic signature or checksum obtained through an independent trusted channel. - Inspect the downloaded script before execution. - Execute it without elevated privileges unless elevation is demonstrably required. 4. Make installation an explicit user-approved step rather than allowing an agent to install tooling automatically. 5. Retain the documented `pip` fallback only after applying the dependency-pinning and verification controls described in the separate dependency finding.