T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:20
- Finding
- Unpinned Remote Toolkit Retrieval Followed by Local Execution## Vulnerability Details **File Location**: `SKILL.md:20-36`; additional execution guidance at `references/command-patterns.md:5-11` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code `SKILL.md:20-36`: ```markdown Only clone or copy the toolkit after the user explicitly approves fetching or installing remote code. 1. Clone or copy the repository: `git clone https://github.com/Malac12/CDP-tools.git "D:\silmairl cdp"` 2. Ensure Chrome, Chromium, or Edge is installed. The toolkit checks standard Windows install paths and falls back to `chrome.exe` on `PATH`. 3. Run the toolkit from PowerShell: `& 'D:\silmairl cdp\silmaril.cmd' openbrowser --json` `& 'D:\silmairl cdp\silmaril.cmd' openUrl 'https://example.com' --json` `& 'D:\silmairl cdp\silmaril.cmd' get-text 'body' --json` This is sufficient for the core CDP workflow. No machine-wide PowerShell execution policy change is required because `silmaril.cmd` invokes PowerShell with `ExecutionPolicy Bypass`. ``` `references/command-patterns.md:5-11`: ```markdown Use the checked-out toolkit directly: ```powershell & 'D:\silmairl cdp\silmaril.cmd' openbrowser --json & 'D:\silmairl cdp\silmaril.cmd' openUrl 'https://example.com' --json ``` If the checkout is not present at that path, resolve `silmaril.cmd` from `PATH` or the local workspace before proceeding. ``` ### Technical Analysis The skill directs the agent to clone a mutable external GitHub repository and subsequently execute `silmaril.cmd`. It does not pin the repository to an immutable commit, verify a cryptographic checksum or signature, or require review of the downloaded files before execution. Consequently, the code that executes can differ from the code assessed when this skill was reviewed. Explicit user approval makes the download more visible, but it does not verify the integrity or trustworthiness of the resulting p ...[truncated 2418 chars]
- Remediation
- ## Remediation Suggestions 1. Vendor the required toolkit implementation into the reviewed skill package so that the executed code is included in the audit boundary. 2. If remote retrieval is unavoidable, pin the repository to a specific immutable commit hash rather than cloning the mutable default branch. 3. Publish an expected cryptographic digest from an independently trusted source and verify all downloaded artifacts before execution. 4. Prefer signed releases and validate the signature against a pinned, trusted maintainer key. 5. Abort installation on any commit, signature, or checksum mismatch. 6. Remove the generic `PATH` and nearby-workspace fallback. Require a canonical absolute path and verify that the resolved file is located beneath the expected installation directory. 7. Review the command wrapper and all transitively invoked scripts before first execution. 8. Avoid `ExecutionPolicy Bypass` where possible. If it is operationally necessary, restrict it to a verified script and a narrowly scoped process. 9. Run the toolkit as a non-administrative user in an isolated environment with access limited to the browser profile, files, and network destinations needed for the task. 10. Preserve explicit user approval, but display the pinned source revision and verification result as part of the approval request.