T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:26- Finding
Unverified Remote Installation Script Executed Directly by Bash
- Content
View full analysis
Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update, > or see [`references/cli-installation-guide.md`](references/cli-installation-guide.md) for installation instructions. ``` ### Technical Analysis The command streams a mutable HTTPS response directly into Bash. The downloaded script is not saved for inspection, pinned to a version, or authenticated using a cryptographic signature or published checksum. The domain appears related to Alibaba Cloud, but domain reputation alone does not establish the integrity of the script returned at execution time. If the hosting infrastructure, distribution pipeline, DNS resolution, trusted certificate chain, or remote script is compromised, the effective payload can change after this Skill has been reviewed. Installing the CLI is ancillary to template generation, and immediate execution of an unverified remote script is not the minimum capability required for the declared functionality. ### Attack Path 1. An attacker compromises the remote script, its hosting infrastructure, or another component in its delivery chain. 2. The Skill detects that Aliyun CLI is missing or outdated. 3. The Agent follows the documented prerequisite and executes the `curl | bash` pipeline. 4. Bash runs the attacker-controlled response immediately under the Agent or user's local account. 5. The payload can access local files, modify configuration, replace executables, read available credentials, or establish persistence using all permissions held by that account. ### Impact Assessment Successful exploitation provides arbitrary local command execution with the privileges of the process running the Skill. If invoked by a privileged user, the ...[truncated 251 chars]- Remediation
View remediation