T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:50
- Finding
- Unpinned Remote Installer Content Is Executed Directly<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:50-58` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```markdown - **macOS / Linux / WSL：** ```bash bash <(curl -fsSL https://unpkg.com/siluzan-cso-cli@latest/dist/skill/scripts/install.sh) ``` - **Windows PowerShell：** ```powershell irm https://unpkg.com/siluzan-cso-cli@latest/dist/skill/scripts/install.ps1 | iex ``` ``` ### Technical Analysis Both installation commands execute content obtained from an external URL without first saving, inspecting, pinning, or verifying it. The `latest` package tag is mutable, meaning that the effective code executed by these commands can change after this Skill version has been reviewed. HTTPS protects the transport connection but does not establish that a future package release, CDN response, or compromised upstream account contains the reviewed installer. The PowerShell form pipes the response directly to `Invoke-Expression`, while the Bash form executes the response through process substitution. Installing the declared CLI is legitimate functionality, but executing an unpinned network response is not the minimum privilege or minimum trust required to perform that installation. ### Attack Path 1. An attacker compromises the npm package publisher, unpkg delivery path, upstream release process, or another component capable of changing the `latest` artifact. 2. The attacker replaces the referenced installer with code that performs unauthorized actions. 3. A user or AI Agent follows the documented one-line installation command. 4. The network response is passed directly to Bash or `Invoke-Expression`. 5. The attacker-controlled code executes with all privileges available to the invoking user or Agent. ### Impact Assessment Successful exploitation provides arbitrary code execution under the invoking account. Depending on that account's privileges, the payload could: - Read ...[truncated 388 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `latest` with an immutable package version. 2. Publish SHA-256 checksums or signed release manifests through an independently controlled channel. 3. Download the installer to a local file rather than piping it directly to a shell. 4. Verify the checksum and, where supported, a cryptographic signature before execution. 5. Present the verified script or its planned operations to the user and obtain explicit consent. 6. Prefer the simpler documented installation command where Node.js is already available: ```bash npm install -g siluzan-cso-cli@1.1.45 ``` 7. For PowerShell, apply an execution flow similar to: ```powershell Invoke-WebRequest -Uri $PinnedUrl -OutFile $Installer if ((Get-FileHash $Installer -Algorithm SHA256).Hash -ne $ExpectedHash) { throw "Installer integrity verification failed" } & $Installer ``` 8. Do not use `Invoke-Expression` for downloaded content. ]]>