T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:42- Finding
Execution of Unpinned Code from an External Repository
- Content
View full analysis
> ~/.secrets # 3. Test echo "Hello" | bash main.sh ``` The downloaded implementation is subsequently selected and executed by `main.sh`: ```bash RUNE_DIR="${RUNE_DIR:-/Users/mustafa/Documents/GitHub/rune}" WAND="$RUNE_DIR/wand.py" ``` ```bash cd "$RUNE_DIR" # Strip ANSI colors from output for clean piping python3 "$WAND" inscribe "$PROMPT" \ | sed $'s/\033\[[0-9;]*m//g' ``` ### Technical Analysis The Skill does not include or implement its declared prompt-amplification engine. Instead, its setup instructions clone a mutable external Git repository and `main.sh` executes `wand.py` from that repository. The clone operation does not pin an immutable commit, verify a cryptographic checksum, validate a signature, or otherwise authenticate the exact content that will be executed. Consequently, the effective executable payload can change after this Skill has been audited. There is also a provenance inconsistency: - `SKILL.md:43` directs users to clone `github.com/mrsarac/master-prompts`. - `SKILL.md:8,55` and `README.md:75` identify repositories under `github.com/neurabytelabs`. This inconsistency makes it harder for users to determine which repository is authoritative and increases the risk of source substitution. `README.md:75` itself is only a GitHub hyperlink and does not directly execute or download anything; the actionable remote retrieval is the clone command in `SKILL.md`. ### Attack Path 1. A user installs the reviewed Skill and follows its documented setup procedure. 2. The user clones the current state of `mrsarac/master-prompts` ...[truncated 1145 chars]- Remediation
View remediation