T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:157- Finding
Privileged Remote Script Downloaded and Executed Without Verification
- Content
View full analysis
/dev/null || echo 0)" if [ "$NODE_MAJOR" -lt 22 ]; then curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - sudo apt install -y nodejs fi ``` ### Technical Analysis The documented installation procedure pipes an externally retrieved shell script directly into a privileged shell. The downloaded response is neither pinned to a specific immutable version nor verified using a checksum or cryptographic signature before execution. Although installing Node.js is relevant to the Skill, executing a mutable network response as root is not the minimum privilege necessary. The effective payload may change after this Skill has been audited. A compromise of the upstream server, DNS resolution, certificate trust chain, or delivery infrastructure could therefore turn this installation instruction into arbitrary privileged code execution. This is a documentation-triggered vulnerability rather than an automatically invoked package lifecycle script. Exploitation requires an operator to follow the documented command. ### Attack Path 1. An operator follows the installation instructions in `README.md`. 2. `curl` retrieves the current response from `deb.nodesource.com`. 3. The response is sent directly to `sudo bash` without local inspection or integrity verification. 4. A compromised or malicious response executes with root privileges. 5. The payload can modify system files, install services, access local credentials, or deploy additional software. ### Impact Assessment Successful exploitation provides arbitrary root-level command execution on the host. This can result in: - Complete host compromise. - Access to OpenClaw, Feishu, model-provider, ...[truncated 281 chars]- Remediation
View remediation