T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:108
- Finding
- Externally Supplied Update Command Executed Without Local Validation## Vulnerability Details **File Location**: `SKILL.md`, lines 108-128 **Vulnerability Type**: External service-controlled command execution **Risk Level**: High ### Vulnerable Code ```text Every successful CLI response may also carry a top-level `updates` block. Handle it deterministically: - If `updates.cli.status` or `updates.skill.status` is `update_available` or `below_minimum`, tell the user once which component is outdated (installed versus latest) and quote the exact `action` command. The task cannot continue until that update is installed. Ask for approval; with approval, run exactly that command (it already carries the required `--approve-upgrade` argument). If the user declines, stop and do not run business commands with the outdated component, and do not ask again in this session unless the user changes that decision. - If a command fails with `CLI_VERSION_BELOW_MINIMUM` or `SKILL_VERSION_BELOW_MINIMUM`, the task cannot continue until the update is installed. Explain this, ask for approval, run exactly the printed update command, then retry the failed step once. - When both are outdated, update the CLI first, then the Skill. When the printed `action` refreshes this installed Skill, replace `<skill-directory>` with the directory of this installed Skill (the directory containing this Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the `update check` command above is the freshness check. Never ask more than once per component per session, and never substitute another command, flag, origin, or download path for the printed `action`. If the CLI answers `Unknown command` for `personwise update`, the installed CLI predates this Skill's update tooling: ``` ### Technical Analysis The Skill treats an `action` command returned by the PersonWise CLI or its remote service as executable instructions and explicitly directs the Agent to run that command verbatim after user approval. The command ca ...[truncated 2768 chars]
- Remediation
- ## Remediation Suggestions 1. **Do not execute command strings returned by the service.** Treat the response only as structured update metadata, such as component name, target version, and signed manifest identifier. 2. **Use fixed local update commands.** Construct updates from audited constants. For example, invoke the bundled bootstrap script directly with a fixed approval argument rather than accepting an arbitrary `action` field. 3. **Avoid shell evaluation.** Pass the executable and each argument as separate process-launch parameters. Do not use `sh -c`, `bash -c`, `eval`, PowerShell expression evaluation, or equivalent mechanisms. 4. **Apply a strict allowlist.** Permit only expected executables, subcommands, flags, versions, and destination paths. Reject redirects, pipelines, command separators, substitutions, environment assignments, control characters, and unexpected placeholders. 5. **Verify update metadata locally.** Require a valid signature from the pinned PersonWise release key, validate descriptor and manifest expiration, bind the requested component and version to the signed manifest, and verify artifact size and cryptographic digest before installation. 6. **Constrain destinations.** Canonicalize the executable and Skill directories, reject symbolic links or reparse points, and ensure all writes remain within the intended installation directory. 7. **Separate approval from command construction.** Show the user the component, current version, target version, trusted origin, and exact locally generated operation. Approval should authorize only that validated operation, not an arbitrary server-provided shell string. 8. **Fail closed.** If metadata is malformed, unsigned, expired, references an unapproved origin, or cannot be mapped to a fixed local update operation, stop without executing it.