T03 · Remote Payload Retrieval and Execution
Error
- Location
- _shared/preflight.md:7
- Finding
- Mutable Remote Installer Is Automatically Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `_shared/preflight.md`, lines 7–27 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```text 1. **Resolve latest stable version**: Fetch the latest stable release tag from the GitHub API: ``` curl -sSL "https://api.github.com/repos/okx/onchainos-skills/releases/latest" ``` Extract the `tag_name` field (e.g., `v1.0.5`) into `LATEST_TAG`. If the API call fails and `onchainos` is already installed locally, skip steps 2-3 and continue with step 4 (the user may be offline or rate-limited; a stale binary is better than blocking). If `onchainos` is **not** installed, **stop** and tell the user to check their network connection or install manually from https://github.com/okx/onchainos-skills. 2. **Install or update**: If `onchainos` is not found, or if the cache at `~/.onchainos/last_check` (`$env:USERPROFILE\.onchainos\last_check` on Windows) is older than 12 hours: - Download the installer and its checksum file from the latest release tag: - **macOS/Linux**: `curl -sSL "https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.sh" -o /tmp/onchainos-install.sh` `curl -sSL "https://github.com/okx/onchainos-skills/releases/download/${LATEST_TAG}/installer-checksums.txt" -o /tmp/installer-checksums.txt` - **Windows**: `Invoke-WebRequest -Uri "https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.ps1" -OutFile "$env:TEMP\onchainos-install.ps1"` `Invoke-WebRequest -Uri "https://github.com/okx/onchainos-skills/releases/download/${LATEST_TAG}/installer-checksums.txt" -OutFile "$env:TEMP\installer-checksums.txt"` - Verify the installer's SHA256 against `installer-checksums.txt`. On mismatch, **stop** and warn — the installer may have been tampered with. - Execute: `sh /tmp/onchainos-install.sh` (or `& "$env:TEMP\onchainos-install.ps1"` on Windows). ``` ...[truncated 3326 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Pin an audited release** - Replace automatic resolution of the latest release with a specific reviewed version. - Pin the installer to an immutable Git commit or release artifact digest rather than a mutable tag lookup. 2. **Use independent signature verification** - Sign installers and binaries with a release-signing key whose public key is embedded in the reviewed Skill package or distributed through a separate trusted channel. - Verify signatures locally before execution. - Do not rely solely on checksums hosted alongside the corresponding artifacts. 3. **Require explicit installation consent** - Before downloading or executing an installer, tell the user that external code will run locally. - Display the source, pinned version, expected digest, and destination path. - Require explicit confirmation, particularly during wallet or transaction workflows. 4. **Separate updates from financial operations** - Do not automatically update the CLI immediately before quoting, signing, or broadcasting a transaction. - Perform updates through a dedicated administrative workflow, followed by integrity validation and review. 5. **Prefer a previously verified local binary** - If an integrity-verified compatible CLI is already installed, use it without a recurring automatic update. - Warn about version drift rather than automatically replacing executable code. 6. **Harden temporary-file handling** - Create a private temporary directory with restrictive permissions. - Use exclusive file creation and reject symbolic links. - Remove downloaded installers and checksum files after verification and execution. 7. **Constrain installer privileges** - Run installation without `sudo` or administrator elevation. - Restrict installation to a user-owned application directory. - Where practical, execute installation in a sandbox with limited filesystem and network access. 8. **Verify the fin ...[truncated 213 chars]