T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:38- Finding
Mutable Remote Installation Scripts Are Executed Directly by the Shell
- Content
View full analysis
`/bin/bash -c "$(curl -fsSL https://aliyuncli.alicdn.com/setup.sh)"` to install or update. ``` ```markdown | Platform | Command | |---|---| | macOS / Linux | `curl -LsSf https://astral.sh/uv/install.sh \| sh` | | Windows (PowerShell) | `powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 \| iex"` | ``` ```bash /bin/bash -c "$(curl -fsSL https://aliyuncli.alicdn.com/install.sh)" ``` ### Technical Analysis The Skill directs users or an agent, after confirmation, to retrieve mutable content from external URLs and immediately execute it using `sh`, `bash`, or PowerShell `Invoke-Expression`. No immutable release reference, cryptographic checksum, publisher signature, or local content review is required before execution. User confirmation reduces the risk of unexpected execution but does not validate the payload. The command displayed for approval does not reveal the script body, and the server can return different content after the Skill has been audited. PowerShell's `ExecutionPolicy Bypass` also removes an execution-policy safeguard for that invocation, although it does not independently grant administrator privileges. The prerequisite instruction references `setup.sh`, while the main installation step references `install.sh`. This inconsistency makes it harder to establish precisely which installer has been reviewed and trusted. ### Attack Path 1. An attacker compromises the remote hosting account, CDN, upstream build process, DNS resolution, or another component in the delivery chain. 2. The attacker replaces the installation response with a malicious shell or PowerShell payload. 3. A user approves and runs the documented command. 4. `curl` or `Invoke-RestMethod` retrieves the changed payload. 5. `sh`, `bash`, or `Invoke-Expression` exe ...[truncated 939 chars]- Remediation
View remediation
``` 4. Obtain the expected SHA-256 digest from independently authenticated, signed release metadata and verify it before execution: ```bash printf '%s %s\n' '' 'uv-install.sh' | sha256sum --check ``` 5. Verify a publisher signature where available and document the expected signer identity. 6. Present the downloaded file path, version, checksum, signer, and intended changes to the user before requesting execution approval. 7. Execute the verified local file as a separate action and with ordinary user privileges. 8. On Windows, avoid `Invoke-Expression` and do not use `ExecutionPolicy Bypass` unless strictly necessary and explicitly justified. 9. Reconcile the inconsistent `setup.sh` and `install.sh` references so only one reviewed, versioned installation path is documented. ]]>