T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:66
- Finding
- Execution of an Unpinned and Unaudited Remote Runner## Vulnerability Details **File Location**: `SKILL.md`, lines 66-85 **Vulnerability Type**: Remote payload retrieval and execution through a mutable external repository **Risk Level**: High ### Vulnerable Code The Skill directs users to obtain the runner from externally maintained repositories: ```text https://github.com/sensedeal/cue-skills https://gitee.com/sensedeal/cue-skills ``` It subsequently instructs the Agent to execute the installed runner: ```bash python3 ~/.cue/cue-skills/cue-research/scripts/research_run.py \ --query "target person background-check report: corporate appointments, external investments, judicial risks, administrative penalties, and business network" \ --template-id template_m4NxQy \ --output ~/cue-reports/$(date +%Y-%m-%d-%H%M)-person-check.md ``` ### Technical Analysis The Skill requires an externally maintained Cue runner to be cloned and executed locally. However, it does not pin the runner to an immutable commit or release and does not provide a cryptographic checksum, digital signature, or bundled copy that can be reviewed with the Skill. The referenced one-click installation section also contains no installation command. Therefore, the provenance and exact version of the runner that will be installed cannot be established from the audited project. Because the external repository and mirror are mutable, the effective code executed by `research_run.py` can change after this Skill has been reviewed. A compromised upstream account, repository, mirror, release process, or network delivery path could substitute malicious Python code while the documented invocation continues to appear legitimate. ### Attack Path 1. An attacker compromises the upstream repository, mirror, maintainer account, or distribution process. 2. The attacker modifies the externally hosted runner or its installation process. 3. A user follows the Skill documentation and obtains the current mutable v ...[truncated 1197 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the runner to a specific immutable Git commit or cryptographically signed release rather than cloning a mutable branch. 2. Publish and verify a SHA-256 digest for every runner artifact before execution. 3. Require signed commits or release signatures and document the trusted signing identity and verification procedure. 4. Bundle the required runner source inside the Skill package so that it is included in security review. 5. Replace the empty installation block with an explicit, reviewable installation procedure that checks the pinned revision and checksum. 6. Avoid silently falling back between GitHub and Gitee mirrors unless both artifacts are independently authenticated and verified as identical. 7. Execute the runner in a sandbox with minimal filesystem and network permissions. 8. Restrict credential exposure by providing the API key only to the process that requires it and preventing access to unrelated user files. 9. Review runner updates before changing the pinned version, and repeat security testing whenever the dependency is updated.