T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:15
- Finding
- Unverified Remote Installer Piped Directly into Bash## Vulnerability Details **File Location**: `SKILL.md`, line 15 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://raw.githubusercontent.com/LedgiApp/ledgi-cli/main/install.sh | bash ``` ### Technical Analysis The installation instruction downloads `install.sh` from the mutable `main` branch of an external GitHub repository and immediately executes the response with Bash. It provides no commit pinning, cryptographic checksum, signature validation, package-manager provenance, or opportunity to inspect the downloaded file before execution. Installing the Ledgi CLI is relevant to the Skill's declared financial-data functionality. However, executing mutable network content directly exceeds the minimum privileges safely necessary to perform that installation. The effective installer can change after this Skill has been reviewed, and the external installer itself is not included in the audited project. Its behavior, destination API endpoints, filesystem changes, and handling of the `LEDGI_API_KEY` therefore cannot be verified from the available files. This creates a supply-chain execution channel. Control or compromise of the upstream repository, its maintainers' credentials, or the delivery trust path could turn the documented prerequisite into arbitrary code execution. ### Attack Path 1. An attacker gains control of the upstream `LedgiApp/ledgi-cli` repository, a maintainer account, or the mutable `main` branch. 2. The attacker replaces or modifies `install.sh` with a malicious payload. 3. A user or agent follows the installation instruction in `SKILL.md`. 4. `curl` retrieves the attacker-controlled script without validating its expected content or identity. 5. The shell executes the response immediately under the invoking user's permissions. 6. The payload can access resources available to that user and may attempt further compromise, including theft of credentials or insta ...[truncated 857 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `curl | bash` installation pattern. 2. Prefer installation from a reputable package registry using an explicitly pinned release version. 3. If direct download is necessary: - Pin the download URL to an immutable release artifact or audited commit rather than `main`. - Publish an expected SHA-256 or stronger cryptographic digest through a separately protected channel. - Download the installer to a local file. - Verify its checksum or trusted digital signature before execution. - Allow the user to inspect the installer before running it. 4. Document the installer operations, required permissions, installed paths, network destinations, and uninstall procedure. 5. Run installation without elevated privileges unless a specific operation demonstrably requires them. 6. Request only the narrow Ledgi API scopes needed for each workflow and avoid exposing the API key through command-line arguments, logs, or installer subprocesses. 7. Consider distributing the CLI reproducibly and publishing signed release provenance so users can verify that the artifact corresponds to reviewed source. A safer pattern would resemble: ```bash curl -fSLo ledgi-install.sh \ "https://raw.githubusercontent.com/LedgiApp/ledgi-cli/<AUDITED_COMMIT>/install.sh" echo "<EXPECTED_SHA256> ledgi-install.sh" | sha256sum --check - less ledgi-install.sh bash ledgi-install.sh ``` The commit and checksum must be replaced with independently verified, immutable values.