T03 · Remote Payload Retrieval and Execution
- Location
SKILL.md:365- Finding
Unverified Remote Installer Executed Directly by a Shell
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 365–368
Vulnerability Type: Remote payload retrieval and execution
Risk Level: HighVulnerable Code
sh # One-liner. Auto-detects OS/arch, downloads binary + 7-day cert, unpacks under ~/.scrapfly/byop curl -fsSL "https://scrapfly.io/install/byop-connector.sh?api_key=YOUR_API_KEY" | sh # Or via the CLI (same end state)Technical Analysis
The installation command downloads a remotely hosted shell script and sends it directly to
sh. The script is not pinned to an immutable version or content digest, and the instructions do not require cryptographic signature or checksum verification. Consequently, the effective code executed by users can change after this Skill has been reviewed.HTTPS protects the transfer in transit but does not establish that future content served by the endpoint is safe. Compromise of the service, installer endpoint, or applicable trust infrastructure—or an intentional server-side payload change—could cause arbitrary commands to execute under the invoking user's account.
Piping directly to a shell also prevents meaningful review of the retrieved script before execution. The documentation states that the script detects the operating system and architecture, downloads a binary and a seven-day certificate, and installs them beneath
~/.scrapfly/byop; however, neither the script nor the resulting binary is included in the project, so their behavior cannot be audited from this artifact.The API key is included in the URL query string. Such URLs may be recorded in service-side access logs or other HTTP telemetry, increasing the chance of credential exposure.
This execution channel exceeds the minimum privileges required for the Skill's principal cloud-browser functionality. Connecting to the documented WebSocket API only requires a client dependency and an API key; arbitrary remote shell execution is only associated with the optional BYOP connector. The c ...[truncated 1899 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the
curl | shinstallation pattern. - Publish versioned, immutable installer and binary artifacts rather than serving mutable content from an unversioned endpoint.
- Require a staged installation process:
- Download the installer or package to a local file.
- Verify a documented SHA-256 digest.
- Verify a cryptographic signature against a separately distributed, trusted public key.
- Allow the user to inspect the installer before execution.
- Execute the verified local artifact explicitly.
- Prefer a reputable package repository with signed metadata and pinned versions where practical.
- Do not transmit API keys in URL query strings. Use a protected environment variable, standard input, an authenticated CLI flow, or an authorization header while ensuring the secret is not written to logs.
- Document the connector's exact files, permissions, executable behavior, update mechanism, certificate storage, network destinations, lifecycle, and uninstall procedure.
- Run the connector under a dedicated, minimally privileged account and isolate it using applicable sandboxing, filesystem restrictions, and network egress controls.
- Require explicit user consent before enabling BYOP traffic, and restrict the connector so it cannot reach internal destinations beyond those necessary for the approved workflow.
- Clearly separate this optional high-trust connector installation from the core cloud-browser setup, which does not require remote shell execution.
- Remove the