T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:50
- Finding
- Automatic Retrieval and Execution of Mutable Remote Code<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:50-70` **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: High ### Vulnerable Code ```python if not DEEPDIVE_ROOT: print("DeepDive not found — installing from GitHub...") install_dir = os.path.expanduser('~/deepdive') subprocess.run( ['git', 'clone', 'https://github.com/Sinndarkblade/deepdive', install_dir], check=True ) subprocess.run( [sys.executable, '-m', 'pip', 'install', '-r', os.path.join(install_dir, 'requirements.txt')], check=True ) DEEPDIVE_ROOT = install_dir print(f"✓ DeepDive installed at {DEEPDIVE_ROOT}") sys.path.insert(0, os.path.join(DEEPDIVE_ROOT, 'core')) sys.path.insert(0, os.path.join(DEEPDIVE_ROOT, 'server')) sys.path.insert(0, os.path.join(DEEPDIVE_ROOT, 'src')) from graph import InvestigationGraph, Entity, Connection from build_board import build_board print(f"✓ DeepDive ready") ``` The skill also recommends directly starting the downloaded server: ```bash cd ~/deepdive && python3 server/app.py ``` ### Technical Analysis The skill clones a mutable GitHub repository without pinning an immutable commit, tag digest, or verified release artifact. It then installs dependencies from a remotely supplied `requirements.txt`, adds downloaded directories to `sys.path`, and imports Python modules from them. Python module imports execute module-level code. Package installation can also execute build-system or installation hooks. Consequently, the effective code executed by the skill is controlled by the current state of an external repository rather than by the reviewed skill package. A repository owner, compromised maintainer account, or attacker who gains control of the upstream repository can alter the payload after this skill has been audited. The separately documented command to run `server/app.py` provides another direct execution path for the unverified remote applic ...[truncated 1389 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove automatic cloning and execution of mutable upstream content. 2. Vendor the required implementation into the reviewed skill package, or use a formally reviewed release artifact. 3. If remote retrieval is unavoidable, pin an immutable Git commit and verify the downloaded content against a trusted cryptographic digest or signature. 4. Do not add downloaded source directories directly to `sys.path` before integrity verification. 5. Require explicit user confirmation before installing dependencies, importing retrieved modules, or starting a server. 6. Run the application in a sandbox or container with: - A dedicated unprivileged account. - Read-only access to required files. - No access to unrelated home-directory content. - Restricted outbound network access. - No inherited secrets unless explicitly required. 7. Pin all transitive dependencies and require hashes for installation. 8. Review the complete upstream source and dependency graph before approving a pinned version. 9. Bind any local server to loopback only, disable unsafe debug functionality, and require authentication where sensitive data or settings are exposed. ]]>