T03 · Remote Payload Retrieval and Execution
Error
- Location
- start_ai.sh:38
- Finding
- Mutable Model Payload Is Executed with Remote Code Trust Enabled<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:20, 130-147`; `start_ai.sh:6, 38-46`; `SKILL.md:122-123` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code `install.sh:20`: ```bash HF_MIRROR="https://hf-mirror.com" ``` `install.sh:130-147`: ```bash download_models() { log_info "下载模型 (这可能需要几分钟)..." source "$VENV_DIR/bin/activate" export HF_ENDPOINT="$HF_MIRROR" # 下载 LLM 模型 log_info "下载 LLM 模型: $MODEL_NAME" python3 -c "from mlx_lm import load; load('$MODEL_NAME')" || { log_warning "LLM 模型下载可能已存在或失败，继续..." } # 下载 Embedding 模型 log_info "下载 Embedding 模型: $EMBEDDING_MODEL" python3 -c "from sentence_transformers import SentenceTransformer; SentenceTransformer('$EMBEDDING_MODEL')" || { log_warning "Embedding 模型下载可能已存在或失败，继续..." } ``` `start_ai.sh:6, 38-46`: ```bash export HF_ENDPOINT=https://hf-mirror.com ``` ```bash nohup python -m mlx_lm.server \ --model mlx-community/Qwen3.5-4B-OptiQ-4bit \ --trust-remote-code \ --temp 0.3 \ --chat-template-args '{"enable_thinking": false}' \ --port 8080 > "$LOG_DIR/chat.log" 2>&1 & ``` `SKILL.md:122-123`: ```bash source ~/mlx-env/bin/activate HF_ENDPOINT=https://hf-mirror.com python3 -c "from mlx_lm import load; load('mlx-community/Qwen3.5-4B-OptiQ-4bit')" ``` ### Technical Analysis The installer retrieves model artifacts through `hf-mirror.com`, a third-party mirror, without pinning an immutable repository revision or validating cryptographic hashes or signatures. The launcher subsequently passes `--trust-remote-code` to the model server. Remote-code trust allows custom implementation code supplied by a model repository to be imported and executed locally. Because the model reference is mutable and no integrity control is enforced, the effective executable payload can change after the Skill package has been reviewed. The local scripts can therefore app ...[truncated 1160 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `--trust-remote-code` unless the selected model strictly requires custom executable code. 2. Prefer a model format and loader that operate entirely on declarative model artifacts. 3. Retrieve artifacts from an official, authenticated source rather than an undocumented third-party mirror. 4. Pin the model to a reviewed immutable commit or revision instead of a mutable repository name. 5. Publish and validate cryptographic hashes or signed manifests before loading downloaded files. 6. If remote model code is unavoidable, vendor the reviewed code into the package, audit it, and execute it in a sandbox with minimal filesystem and network access. 7. Require explicit user confirmation explaining that model-supplied code will execute locally. 8. Fail closed when model verification or download fails rather than continuing after a warning. ]]>