T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:19
- Finding
- Unverified Remote Installer Executed Directly Through Bash## Vulnerability Details **File Location**: `SKILL.md`, line 19 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable Code**: ```bash curl -sSfL https://get.tur.so/install.sh | bash ``` ### Technical Analysis The Linux/WSL installation instructions retrieve a mutable script from an external URL and pass it directly to Bash. The command does not pin a release, verify a cryptographic signature or checksum, save the script for inspection, or otherwise establish that the downloaded content matches a reviewed payload. Although HTTPS provides transport protection, it does not protect against compromise of the distribution server, domain, redirect destination, or trusted certificate infrastructure. The `-L` option also follows redirects, allowing the final payload to be obtained from a different endpoint. Because the script is executed immediately, any attacker-controlled response can run arbitrary shell commands with the privileges of the user following the instructions. Installing the Turso CLI is consistent with the Skill's declared functionality, but direct execution of mutable network content exceeds the minimum mechanism necessary. A version-pinned and integrity-verified package or release artifact can provide the required CLI without this execution pattern. ### Attack Path 1. An attacker compromises or gains control over the installer endpoint, its hosting infrastructure, a redirect destination, or another relevant component of the delivery chain. 2. The attacker modifies the HTTP response so that it contains malicious shell commands. 3. A user or Agent follows the Linux/WSL setup instructions in `SKILL.md`. 4. `curl` downloads the current response and follows any redirects. 5. The pipeline sends the response directly to Bash without integrity validation or prior inspection. 6. The attacker's commands execute with the invoking user's privileges. ### Impact Assessment ...[truncated 764 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the `curl | bash` pipeline with an official, version-pinned package or release artifact. 2. Publish and verify a cryptographic signature from a trusted maintainer key. If signatures are unavailable, verify a SHA-256 checksum obtained through an independently trusted channel. 3. Do not silently follow redirects during security-sensitive installation unless every allowed destination is explicitly documented and trusted. 4. Download the artifact to a local file first, validate its expected type and integrity, and only then install it. 5. If a shell script is unavoidable, require users to download and inspect it separately before execution rather than piping it directly into a shell. 6. Run installation with ordinary user privileges and avoid `sudo` unless a specific installation step demonstrably requires it. 7. Document the exact release version, expected checksum or signing identity, download host, files created, and permissions required.