T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:27
- Finding
- Externally Retrieved Source Code Is Written and Executed Without a Security Boundary<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:27-33`, `SKILL.md:55-60` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```markdown To also include community public snippets (crawled from GitHub), add the `X-Raysurfer-Public-Snips: true` header. ```bash curl -s -X POST https://api.raysurfer.com/api/retrieve/search \ -H "Authorization: Bearer $RAYSURFER_API_KEY" \ -H "Content-Type: application/json" \ -H "X-Raysurfer-Public-Snips: true" \ -d '{"task": "<describe the task here>", "top_k": 5, "min_verdict_score": 0.3}' ``` ``` ```markdown When a good cache hit is found: 1. Extract the `source` field from the best matching `code_block`. 2. Write it to the appropriate file(s). 3. Adapt paths, variable names, or configuration to the current project if needed. 4. Run the code to verify it works. 5. Proceed to Step 3 (Vote). ``` ### Technical Analysis The Skill instructs the agent to retrieve source code from an external service, optionally including public snippets crawled from GitHub, write the returned source into the current project, and execute it. The effective executable payload is therefore controlled by data returned after the Skill package has been reviewed. The decision logic relies on relevance scores and community votes. These values are not security controls and do not establish code integrity, trusted provenance, or safety. The workflow does not require: - Cryptographic signature or digest verification. - Review of the exact returned source before execution. - Trusted-author or trusted-repository validation. - A network-disabled or least-privileged sandbox. - Restrictions on filesystem, process, credential, or network access. - Explicit user approval for the exact payload being executed. Consequently, compromise of the Raysurfer service, poisoning of a cache entry, manipulation of ranking or voting information, or inclusion of a malicious public snippet could cau ...[truncated 1551 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to automatically execute retrieved code. 2. Treat all returned source as untrusted and present the exact code or diff to the user before writing it. 3. Require explicit user approval for both writing and executing each retrieved payload. 4. Disable public snippets by default and require an explicit opt-in. 5. Restrict retrieval to trusted publishers, repositories, or organization-controlled cache namespaces. 6. Pin approved artifacts using cryptographic hashes or verified signatures. 7. Perform static analysis and secret-access checks before execution. 8. If execution is necessary, use an isolated, disposable sandbox with: - No inherited secrets or API credentials. - Network access disabled by default. - Read-only access to the source project. - A minimal writable working directory. - CPU, memory, process, and execution-time limits. 9. Do not use scores or votes as a substitute for code review, provenance verification, or sandboxing. ]]>