T03 · Remote Payload Retrieval and Execution
Error
- Location
- README.md:48
- Finding
- Unverified Remote Installer Is Downloaded and Executed Directly## Vulnerability Details **File Location**: `README.md:48-60`; `SKILL.md:49-64` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code `README.md:48-60`: ```powershell # Windows (PowerShell) pip install uv # Or using installer powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex" ``` ```bash # macOS/Linux pip install uv # Or using installer curl -LsSf https://astral.sh/uv/install.sh | sh ``` `SKILL.md:49-64`: ```powershell # Using pip pip install uv # Or using PowerShell installer powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex" ``` ```bash # Using pip pip install uv # Or using curl installer curl -LsSf https://astral.sh/uv/install.sh | sh ``` ### Technical Analysis Both installation guides instruct users to retrieve mutable code from an external URL and pass it directly to a command interpreter. The downloaded content is not pinned to a version, inspected, or verified using a checksum or cryptographic signature. The PowerShell variant additionally starts a process with `ExecutionPolicy ByPass`. Although this does not necessarily grant administrative privileges, it removes a local script-execution safeguard for that process. HTTPS authenticates the server connection but does not ensure that the retrieved installer remains identical to the version reviewed with this project. The effective code can change following an upstream account compromise, hosting compromise, dependency compromise, or unauthorized modification of the installer. This behavior is not required for the Skill's core functionality because the same documentation already provides `pip install uv` as an alternative. It therefore exceeds the minimum-risk installation method necessary for the declared travel-brochure workflow. ### Attack Path 1. An attacker compromises the upstream installer host, publi ...[truncated 940 chars]
- Remediation
- ## Remediation Suggestions 1. Remove both pipe-to-interpreter installation alternatives from `README.md` and `SKILL.md`. 2. Prefer installation through a trusted package manager using an exact reviewed version: ```bash python -m pip install "uv==REVIEWED_VERSION" ``` 3. If a standalone installer is necessary, split download and execution into separate steps. 4. Pin the installer to a versioned URL rather than a mutable generic endpoint. 5. Verify the downloaded artifact against a checksum or signature published through an independent trusted channel. 6. Avoid `ExecutionPolicy ByPass`; use an appropriately signed script and the least-permissive execution policy. 7. Tell users to inspect the downloaded script before execution and not to run installation commands from an elevated shell unless explicitly necessary.