T03 · Remote Payload Retrieval and Execution
Error
- Location
- skill.md:26
- Finding
- Unverified Remote Installer Is Piped Directly into a Shell## Vulnerability Details **File Location**: `skill.md`, line 26 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://raw.githubusercontent.com/dawnlabsai/lws/main/lws/install.sh | bash ``` ### Technical Analysis The installation command retrieves a shell script from the mutable `main` branch of an external GitHub repository and immediately executes it with `bash`. It provides no opportunity to inspect the downloaded content and performs no release-version pinning, cryptographic checksum verification, or signature validation. Consequently, the payload executed by users can differ from the content reviewed during this audit. Compromise of the upstream repository, maintainer account, branch, or hosting path—or a malicious future upstream change—would turn this documented installation flow into an arbitrary-code-execution channel. The documented installer operations include: 1. Installing Rust through `rustup` if necessary. 2. Cloning and compiling an external repository. 3. Writing an executable to `~/.lws/bin/lws`. 4. Editing shell configuration to add that directory to `PATH`. These operations introduce additional remote code and modify persistent user configuration. They exceed the minimum privileges needed merely to present or document the CLI's wallet operations. Although PATH modification is disclosed, the audited package contains only `skill.md`, so the actual installer and CLI implementations could not be validated. This risk is especially consequential because the CLI is intended to receive wallet mnemonic phrases and sign messages. A substituted installer or executable could capture those secrets or falsify signing behavior. ### Attack Path 1. An attacker compromises the upstream `dawnlabsai/lws` repository, a maintainer account, or another part of the remote delivery chain. 2. The attacker changes `lws/install.sh` on the mutable `main` branch to include malicious sh ...[truncated 1299 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `curl ... | bash` installation pattern. 2. Publish versioned release artifacts rather than installing from a mutable branch. 3. Pin downloads to an immutable release or commit. 4. Publish cryptographic checksums and signed provenance for release artifacts. 5. Download the installer as a separate file, verify its checksum or signature, and allow inspection before execution. 6. Avoid automatically installing toolchains or modifying shell startup files unless the user gives explicit, informed approval. 7. Clearly enumerate every file and shell configuration entry the installer will create or modify. 8. Build in a constrained environment and audit or lock Rust dependencies before distribution. 9. For a wallet-signing utility, use reproducible builds where practical and document how users can verify that a distributed binary corresponds to reviewed source. 10. Prefer secure secret input mechanisms that do not expose mnemonic phrases through command-line arguments, although the local implementation was unavailable to determine whether alternatives already exist.