T03 · Remote Payload Retrieval and Execution
Warning
- Location
- _shared/preflight.md:18
- Finding
- Automatic Retrieval and Execution of a Mutable Remote Installer<![CDATA[ ## Vulnerability Details **File Location**: `_shared/preflight.md`, lines 18–28 **Vulnerability Type**: Remote payload retrieval and execution with insufficiently independent integrity verification **Risk Level**: Medium ### Vulnerable Code ```markdown 2. **Install or update**: If `onchainos` is not found, or if the cache at `~/.onchainos/last_check` (`$env:USERPROFILE\.onchainos\last_check` on Windows) is older than 12 hours: - Download the installer and its checksum file from the latest release tag: - **macOS/Linux**: `curl -sSL "https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.sh" -o /tmp/onchainos-install.sh` `curl -sSL "https://github.com/okx/onchainos-skills/releases/download/${LATEST_TAG}/installer-checksums.txt" -o /tmp/installer-checksums.txt` - **Windows**: `Invoke-WebRequest -Uri "https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.ps1" -OutFile "$env:TEMP\onchainos-install.ps1"` `Invoke-WebRequest -Uri "https://github.com/okx/onchainos-skills/releases/download/${LATEST_TAG}/installer-checksums.txt" -OutFile "$env:TEMP\installer-checksums.txt"` - Verify the installer's SHA256 against `installer-checksums.txt`. On mismatch, **stop** and warn — the installer may have been tampered with. - Execute: `sh /tmp/onchainos-install.sh` (or `& "$env:TEMP\onchainos-install.ps1"` on Windows). ``` ### Technical Analysis The preflight procedure instructs the agent to determine the latest release dynamically, download an installation script from an external GitHub repository, and execute that script locally. Consequently, the effective code executed by the Skill can change after the reviewed Skill package has been published. The checksum validation reduces accidental corruption and some network-tampering risks. However, both the installer and its checksum manifest are retrieved dynamically from infrastructure controlled by the same repository owner. If ...[truncated 2932 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Separate installation from normal Skill execution** - Do not automatically download or execute an installer as part of routine market-data requests. - If the CLI is missing, stop and provide manual installation instructions. - Require explicit, informed user approval before every installation or update. 2. **Pin reviewed artifacts** - Pin a specific audited CLI and installer version instead of resolving the latest release dynamically. - Store the expected SHA-256 digest in the reviewed Skill package rather than downloading it from the same publishing boundary as the executable. - Update the pinned version and digest only through a reviewed Skill release. 3. **Use cryptographic release signatures** - Require signed release metadata or artifacts. - Pin the trusted signing public key or certificate independently in the Skill. - Reject unsigned releases, invalid signatures, unexpected signers, and rollback attempts. 4. **Avoid executing installer scripts where possible** - Prefer a platform package manager with signature verification and version pinning. - Alternatively, download a platform-specific binary, verify it against independently trusted metadata, and install it without running a general-purpose shell script. 5. **Secure temporary-file handling** - Create a private temporary directory with restrictive permissions using `mktemp -d` or an equivalent secure API. - Reject symbolic links and ensure files are owned by the current user. - Verify and execute the same immutable file descriptor or securely rename the verified artifact to prevent time-of-check/time-of-use replacement. - Delete temporary artifacts after completion. 6. **Constrain installer privileges** - Never invoke `sudo`, request administrator access, or write outside a narrowly defined user-owned installation directory. - Run installation in a sandbox with restricted filesystem and network access where su ...[truncated 343 chars]