T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:17
- Finding
- Remote Installation Script Executed Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md`, line 17 **Vulnerability Type**: Remote code retrieval and immediate shell execution **Risk Level**: High **Complete Code Snippet**: ```bash curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash ``` ### Technical Analysis The deployment instructions pipe content downloaded from an external URL directly into Bash. This creates a remote code-execution channel because no local review, cryptographic signature validation, or checksum verification occurs before execution. The URL refers to the official `nvm-sh/nvm` GitHub repository and uses a version tag, which reduces accidental version drift. However, a Git tag does not provide the same assurance as verification against a trusted cryptographic digest or signature. If the repository, referenced tag, hosting account, delivery infrastructure, or retrieved content were compromised, the effective script could execute arbitrary commands before the user could inspect it. Installing NVM is relevant to the declared deployment workflow, but immediate `curl | bash` execution is not the minimum-risk method required to perform that installation. ### Attack Path 1. An attacker compromises the upstream repository, maintainer account, referenced release content, or another component of the delivery chain. 2. The remote `install.sh` content is replaced or modified to include an attacker-controlled payload. 3. A user follows the documented installation command. 4. `curl` retrieves the modified content and streams it directly to Bash. 5. Bash executes the payload with all permissions available to the invoking user. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account running the deployment command. The payload could read or alter files accessible to that account, modify shell configuration, steal local credentials or tokens, install additional user-level component ...[truncated 274 chars]
- Remediation
- ## Remediation Suggestions 1. Download the installer to a local file instead of piping it directly into a shell. 2. Publish and verify a trusted SHA-256 or stronger cryptographic digest before execution. 3. Prefer a signed release artifact and validate its signature against a documented maintainer key. 4. Review the downloaded script before running it. 5. Execute the installer as an unprivileged user and avoid adding `sudo`. 6. Fail safely by enabling strict download options and explicitly checking verification results. Example hardened workflow: ```bash curl --fail --show-error --location \ --output /tmp/nvm-install.sh \ https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh echo '<TRUSTED_SHA256> /tmp/nvm-install.sh' | sha256sum --check - less /tmp/nvm-install.sh bash /tmp/nvm-install.sh rm -f /tmp/nvm-install.sh ``` The expected digest must be obtained through a trusted, independently authenticated source and must not be fetched from the same unverified channel at execution time.