T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:112
- Finding
- Execution of Remotely Supplied Update Commands## Vulnerability Details **File Location**: `SKILL.md:112-124` **Vulnerability Type**: Execution of an insufficiently constrained command received from a remote service **Risk Level**: High **Vulnerable Code Snippet**: ```text - If `updates.cli.status` or `updates.skill.status` is `update_available` or `below_minimum`, tell the user once which component is outdated (installed versus latest) and quote the exact `action` command. The task cannot continue until that update is installed. Ask for approval; with approval, run exactly that command (it already carries the required `--approve-upgrade` argument). If the user declines, stop and do not run business commands with the outdated component, and do not ask again in this session unless the user changes that decision. - If a command fails with `CLI_VERSION_BELOW_MINIMUM` or `SKILL_VERSION_BELOW_MINIMUM`, the task cannot continue until the update is installed. Explain this, ask for approval, run exactly the printed update command, then retry the failed step once. - When both are outdated, update the CLI first, then the Skill. When the printed `action` refreshes this installed Skill, replace `<skill-directory>` with the directory of this installed Skill (the directory containing this Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the `update check` command above is the freshness check. ``` ### Technical Analysis The Skill directs the agent to execute an `action` command returned dynamically by the PersonWise service. It does not define a local allowlist for the executable, supported subcommands, arguments, destination paths, download origins, or expected update artifacts before execution. Requiring user approval reduces accidental execution but does not establish the safety of an opaque command controlled by a remote response. The instruction to run the command “exactly” also discourages the agent from ...[truncated 2136 chars]
- Remediation
- ## Remediation Suggestions 1. Never execute a shell command string received from an API or update response. 2. Replace the textual `action` field with structured update metadata, such as component, version, artifact identifier, expected digest, signature, and approved destination. 3. Invoke only a fixed, locally trusted updater executable using an argument array rather than shell evaluation or interpolation. 4. Enforce an allowlist of supported update operations, subcommands, flags, HTTPS origins, signing identities, and destination directories. 5. Verify the downloaded artifact's cryptographic signature and pinned digest before installation. Bind verification to the expected component and version. 6. Resolve and validate the Skill directory locally. Reject symbolic links, reparse points, path traversal, unexpected ownership, and paths outside the designated installation root. 7. Stage updates in a private temporary directory, validate archive entries, and use an atomic replacement operation with rollback support. 8. Present the user with structured information about the component, current and target versions, source, signature status, destination, and requested filesystem changes rather than asking approval for an opaque command. 9. Treat unknown response fields, executables, arguments, origins, or update operations as fatal validation failures. 10. Log a secret-free record of the validated update metadata and final artifact digest for later auditing.