T03 · Remote Payload Retrieval and Execution
Error
- Location
setup.sh:33- Finding
Remote get-pip Payload Is Downloaded and Executed Without Verification
- Content
View full analysis
/dev/null; then echo "✓ $($PY -m pip --version)" else echo " pip not found — installing via ensurepip..." if $PY -m ensurepip --upgrade 2>/dev/null; then echo "✓ pip installed via ensurepip" else echo " ensurepip unavailable — trying package manager..." if command -v apt-get &>/dev/null; then sudo apt-get install -y python3-pip elif command -v yum &>/dev/null; then sudo yum install -y python3-pip elif command -v dnf &>/dev/null; then sudo dnf install -y python3-pip elif command -v brew &>/dev/null; then brew install python # pip is bundled with Homebrew Python else echo " Falling back to get-pip.py..." curl -sSL https://bootstrap.pypa.io/get-pip.py | $PY fi fi # Upgrade pip to latest $PY -m pip install --upgrade pip --quiet echo "✓ $($PY -m pip --version)" fi ``` ### Technical Analysis The fallback installation path downloads Python source code from an external URL and pipes it directly into the selected Python interpreter. The payload is not pinned to a known digest, downloaded for inspection, or authenticated through an independently verified signature. Consequently, the effective code executed by the audited package can change after the package itself has been reviewed. HTTPS protects the connection in transit but does not make a mutable upstream payload reproducible or protect against upstream compromise, certificate-authority compromise, or an incorrectly configured proxy trust environment. The exposure is amplified by `SKILL.md`, which ...[truncated 1246 chars]- Remediation
View remediation