T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:105- Finding
Unverified Remote Installer Is Executed Directly by Bash
- Content
View full analysis
= 3.3.3 (required baseline), then verify. curl -fsSL https://aliyuncli.alicdn.com/install.sh | bash aliyun version # must report >= 3.3.3; re-run install.sh to upgrade if lower ``` ### Technical Analysis The Skill downloads a mutable shell script and pipes it directly into Bash. The downloaded content is not pinned to a reviewed version and is not verified using a cryptographic checksum or digital signature before execution. HTTPS protects the connection in transit, but it does not protect against compromise of the CDN, DNS infrastructure, publishing account, remote web server, or upstream release process. It also does not ensure that the script executed later is the same script reviewed during this audit. This installation behavior is not the minimum privilege necessary to deploy a PAI-EAS service. The repository's installation guide already documents package-manager and separately downloaded binary alternatives, which allow verification before execution. ### Attack Path 1. An attacker compromises the installer hosting infrastructure, CDN, publishing credentials, or an upstream deployment process. 2. The attacker replaces `install.sh` with a malicious shell payload. 3. The Skill reaches its mandatory pre-check and executes the documented command. 4. `curl` retrieves the attacker-controlled response. 5. Bash immediately executes the response without inspection or integrity verification. 6. The payload runs with all permissions of the Agent process and may access local files, CLI credentials, environment variables, and authenticated cloud tooling. ### Impact Assessment Successful exploitation provides arbitrary command execution under the operating-system identity running the Skill. Depending on that identity and its c ...[truncated 612 chars]- Remediation
View remediation