T03 · Remote Payload Retrieval and Execution
Error
- Location
- references/setup.md:18
- Finding
- Mutable Remote Installer and Container Images Permit Unreviewed Code Execution## Vulnerability Details **File Location**: `references/setup.md`, lines 18-25 **Vulnerability Type**: Remote payload retrieval and insecure dependency pinning **Risk Level**: High ### Vulnerable Code ```bash ## Quick Install (wrapper) The one-liner installer pulls the image, creates persistent Codex/SSH dirs, and installs the `codexbox` wrapper on `PATH`. **Recommended: download, inspect, then run.** Piping a remote script straight into bash executes unreviewed remote code as you. Download it, read it, then run it: ```bash curl -fsSL -o install.sh https://raw.githubusercontent.com/psyb0t/docker-codexbox/master/install.sh less install.sh # read it before running anything bash install.sh # minimal image — default # CODEXBOX_FULL=1 bash install.sh # full image — every development tool pre-installed # bash install.sh codex # custom command name ``` ``` The same documentation identifies mutable container tags at `references/setup.md:71-73`: ```text | Minimal (default) | `psyb0t/codexbox:latest` | Codex, Node.js, Python, `uv`, Docker, Git, `jq`, `curl` | | Full | `psyb0t/codexbox:latest-full` | Everything in minimal + Go, gopls/Delve/golangci-lint/staticcheck/gofumpt, Python lint/type/test tooling, JS/TS lint/format/framework CLIs, GitHub CLI, Terraform, kubectl, Helm, build tools (CMake/ClangFormat/Valgrind/GDB/strace/ltrace), Postgres/MySQL/SQLite/Redis clients, editors/shell tools | ``` ### Technical Analysis The installation process retrieves a shell script from the mutable `master` branch of a personal GitHub repository and subsequently executes it with the invoking user's permissions. The downloaded installer is not included in the audited project, and the documentation provides no immutable commit reference, expected checksum, or signature. Asking the user to inspect the script is safer than directly piping it into a shell, but it is not a reliable integrity con ...[truncated 2371 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the installer URL to a reviewed immutable Git commit instead of `master`. 2. Publish an expected SHA-256 digest and verify it before execution. Prefer a signed release artifact with signature verification. 3. Vendor the installer into the Skill package so that its complete behavior is included in security review. 4. Pin container images by immutable digest, for example `repository@sha256:...`, rather than using `latest` tags. 5. Make SSH-key generation explicitly opt-in and clearly display the affected paths before changing them. 6. Require confirmation before installing wrappers into system-wide command directories. 7. Avoid mounting SSH state, Codex authentication state, or the Docker socket unless the requested operation specifically requires each capability. 8. Document a verified update procedure that requires review and digest changes whenever the installer or image is upgraded.