T03 · Remote Payload Retrieval and Execution
Error
- Location
- domains/environment.json:7
- Finding
- Unverified Remote Installer Downloaded and Executed Directly## Vulnerability Details **File Location**: `domains/environment.json:7-9` **Additional Reference**: `SKILL.md:72` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```json "macos": "curl -LsSf https://astral.sh/uv/install.sh | sh", "linux": "curl -LsSf https://astral.sh/uv/install.sh | sh", "windows": "powershell -ExecutionPolicy ByPass -c \"irm https://astral.sh/uv/install.ps1 | iex\"" ``` ### Technical Analysis The macOS and Linux commands pipe a remotely downloaded script directly into a shell. The Windows command uses the equivalent PowerShell pattern, downloading a remote script with `irm` and immediately executing it with `iex`; it also bypasses the configured PowerShell execution policy. Although `astral.sh` is consistent with the declared purpose of installing the uv package manager, the downloaded payload is mutable and is not pinned to a reviewed version, checked against a cryptographic hash, or verified with a digital signature. Consequently, the code that actually executes can differ from the content reviewed during this audit. The Skill is a human-in-the-loop guide and does not execute these commands autonomously. This reduces automatic exploitation risk but does not eliminate the vulnerability: users are explicitly instructed to execute the commands in their terminals. ### Attack Path 1. A user starts the first-run environment setup tutorial. 2. The Skill selects the installation command for the user's operating system. 3. The user executes the provided command in a local terminal. 4. The command retrieves a mutable installer from `astral.sh`. 5. The response body is passed directly to a shell or PowerShell interpreter without inspection or integrity verification. 6. If the hosting infrastructure, publisher account, DNS/TLS trust chain, or delivered installer is compromised, attacker-controlled commands execute locally. 7. The malicious ...[truncated 1062 chars]
- Remediation
- ## Remediation Suggestions - Prefer a trusted operating-system package manager with a version constraint instead of executing an Internet-delivered script. - If an installer script is unavoidable, divide retrieval and execution into separate steps: 1. Download a version-specific installer to a local file. 2. Obtain the expected SHA-256 or stronger digest through an independently authenticated release channel. 3. Verify the digest or publisher signature. 4. Allow the user to inspect the downloaded script. 5. Execute it only after explicit confirmation. - Pin the installer to a reviewed release rather than using a mutable generic installation URL. - Remove `-ExecutionPolicy ByPass` and `iex` from the Windows instructions. - Do not recommend running the installer as an administrator unless a documented operation strictly requires elevation. - Document the exact files, directories, and environment settings changed by the installer. - Update `SKILL.md` and the tutorial to present the verified installation method as the default, rather than merely warning users about the risks of the current method.