T03 · Remote Payload Retrieval and Execution
Error
- Location
invoice-issue-install.md:14- Finding
Unverified Remote Binary Download and Execution
- Content
View full analysis
" $binPath = "" Invoke-WebRequest -Uri $binUrl -OutFile $binPath -UseBasicParsing Write-Output "download complete" ``` ```powershell powershell -ExecutionPolicy Bypass -File "" ``` The installation table subsequently directs the Agent to download platform-specific executables from these external locations and execute them: ```text https://download.ningmengyun.com/Skills/invoice-issue/bin/windows-amd64/invoice-assistant_windows_amd64-0.1.0.exe https://download.ningmengyun.com/Skills/invoice-issue/bin/linux-amd64/invoice-assistant_linux_amd64-0.1.0 https://download.ningmengyun.com/Skills/invoice-issue/bin/linux-arm64/invoice-assistant_linux_arm64-0.1.0 https://download.ningmengyun.com/Skills/invoice-issue/bin/darwin-amd64/invoice-assistant_darwin_amd64-0.1.0 https://download.ningmengyun.com/Skills/invoice-issue/bin/darwin-arm64/invoice-assistant_darwin_arm64-0.1.0 ``` ### Technical Analysis The Skill requires an Agent to retrieve an opaque native executable from an external server, place it in a trusted Skill directory, and execute it. It also requires consulting a mutable remote installation document before use. No SHA-256 digest, signed manifest, publisher signature, reproducible build reference, or other cryptographic integrity control is provided. Checking that the downloaded file exists and running it with `--help` do not establish authenticity. A malicious executable can perform arbitrary actions before producing expected help output. Use of `-ExecutionPolicy Bypass` further weakens local script-execution prot ...[truncated 1512 chars]- Remediation
View remediation