T03 · Remote Payload Retrieval and Execution
Error
- Location
setup-wallet.sh:23- Finding
Unpinned Remote Installer Is Piped Directly into a Shell
- Content
View full analysis
/dev/null; then echo "" echo "❌ 'cast' not found. Foundry is required to generate wallets." echo "" echo "To install Foundry, run:" echo " curl -L https://foundry.paradigm.xyz | bash" echo " foundryup" echo "" echo "Or visit: https://book.getfoundry.sh/getting-started/installation" ``` `check-balance.sh:21-29`: ```bash # Check USDC balance on-chain if command -v cast &> /dev/null; then BALANCE_WEI=$(cast call "$USDC_CONTRACT" "balanceOf(address)(uint256)" "$WALLET_ADDRESS" --rpc-url "$RPC_URL") BALANCE_USDC=$(echo "scale=2; $BALANCE_WEI / 1000000" | bc) echo "💰 USDC Balance: $BALANCE_USDC USDC" else echo "⚠️ Install Foundry to check on-chain balance: curl -L https://foundry.paradigm.xyz | bash" fi ``` `README.md:55-60`: ```bash 3. **Foundry installation:** This skill requires Foundry (cast command). Install it manually: ```bash curl -L https://foundry.paradigm.xyz | bash foundryup ``` ``` `SECURITY.md:48-53`: ```bash The skill requires Foundry (cast command) for wallet generation. Install manually: ```bash curl -L https://foundry.paradigm.xyz | bash foundryup ``` ``` ### Technical Analysis The recommended command downloads a mutable response from an external URL and immediately executes it with Bash. The downloaded content is not pinned to a release, authenticated with a detached signature, checked against a known digest, or saved for inspection before execution. Although the current URL is presented as the official Foundry installer, the effective code executed by users can change after the Skill has been audited. Compromise of the hosting infrastructure, upstream in ...[truncated 1790 chars]- Remediation
View remediation