T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:23
- Finding
- Unverified Remote Binary Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md:23-37`; `references/commands.md:22-38` **Vulnerability Type**: Remote payload retrieval and execution through an unverified, mutable release artifact **Risk Level**: High ### Vulnerable Code `SKILL.md:23-37`: ```bash # Detect platform OS=$(uname -s | tr '[:upper:]' '[:lower:]') # linux or darwin ARCH=$(uname -m) [ "$ARCH" = "x86_64" ] && ARCH="amd64" [ "$ARCH" = "aarch64" ] && ARCH="arm64" # Get latest release tag TAG=$(curl -sf https://api.github.com/repos/a652/dmp-cli/releases/latest | grep '"tag_name"' | cut -d'"' -f4) # Download binary FILENAME="dmp-${TAG}-${OS}-${ARCH}" curl -fL "https://github.com/a652/dmp-cli/releases/download/${TAG}/${FILENAME}" -o /usr/local/bin/dmp chmod +x /usr/local/bin/dmp ``` `references/commands.md:22-38`: ```bash OS=$(uname -s | tr '[:upper:]' '[:lower:]') ARCH=$(uname -m) case "$ARCH" in x86_64) ARCH="amd64" ;; aarch64|arm64) ARCH="arm64" ;; esac TAG=$(curl -sf https://api.github.com/repos/a652/dmp-cli/releases/latest | grep '"tag_name"' | cut -d'"' -f4) FILENAME="dmp-${TAG}-${OS}-${ARCH}" curl -fL "https://github.com/a652/dmp-cli/releases/download/${TAG}/${FILENAME}" -o dmp chmod +x dmp sudo mv dmp /usr/local/bin/ dmp version ``` ### Technical Analysis The installation procedure resolves the mutable GitHub `latest` release at runtime, downloads an executable from that release, grants it execute permission, and installs it on the system `PATH`. The reference procedure immediately executes the downloaded artifact with `dmp version`. No cryptographic checksum, digital signature, signed provenance statement, or immutable artifact digest is verified before installation or execution. Consequently, the effective code executed by a user or agent can change after the skill itself has been reviewed. HTTPS protects the connection in transit but does not protect against compromise o ...[truncated 2294 chars]
- Remediation
- ## Remediation Suggestions 1. Pin installation instructions to a reviewed, immutable release version rather than resolving `releases/latest` at runtime. 2. Publish SHA-256 or stronger checksums through a separately protected channel and verify the selected artifact before granting execute permission: ```bash echo "$EXPECTED_SHA256 $FILENAME" | sha256sum --check - ``` 3. Prefer cryptographically signed release artifacts and verify signatures against a documented, pinned public key. Consider Sigstore/Cosign attestations with identity and issuer restrictions. 4. Fail closed if the checksum, signature, release version, operating system, or architecture does not match an explicitly supported value. 5. Avoid parsing GitHub API JSON using `grep` and `cut`; use a proper JSON parser and validate the resulting tag against a strict version pattern. This does not replace artifact verification. 6. Download into a newly created, permission-restricted temporary directory and use safe shell settings such as `set -euo pipefail`. 7. Install into a user-scoped directory unless system-wide installation is operationally necessary. Do not use `sudo` in automated agent workflows. 8. Do not execute the binary, including for a version check, until all integrity and provenance checks succeed. 9. Document the expected repository ownership, release-signing identity, checksum source, and key-rotation process so operators can validate provenance independently. 10. Where feasible, distribute the CLI through a managed package repository that supports version pinning, signed metadata, and reproducible provenance.