T03 · Remote Payload Retrieval and Execution
Warning
- Location
- SKILL.md:31
- Finding
- Unverified Remote Repository and Dependency Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 31-35 **Vulnerability Type**: Remote payload retrieval and insecure software supply chain **Risk Level**: Medium ### Vulnerable Code ```bash git clone --branch v1.0.0 https://github.com/superxs777/fastfish-lite.git cd fastfish-lite pip install -r requirements.txt copy .env.example .env python main.py ``` ### Technical Analysis The installation procedure retrieves an external Git repository, installs the dependencies declared by that repository, and executes its application. Although using a version tag is safer than using a moving branch, a Git tag is not necessarily immutable and does not cryptographically verify the retrieved content. The referenced repository, application scripts, and `requirements.txt` are not included in the audited Skill package. Consequently, their effective behavior cannot be established from the reviewed artifact. The instructions also do not require dependency hashes, artifact signatures, or verification against a reviewed commit SHA. This creates two related risks: 1. The external repository is an execution channel whose payload could differ from the code originally reviewed. 2. The dependency installation step could execute compromised or otherwise unsafe third-party package installation logic. The document warns users about supply-chain risk and recommends isolation and non-root execution. These precautions reduce potential impact but do not verify the integrity of the retrieved code. ### Attack Path 1. An attacker compromises the external repository, a maintainer account, the referenced tag, or a dependency source. 2. The attacker modifies application code, dependency declarations, or package installation behavior. 3. A user follows the documented installation procedure and clones the affected repository. 4. `pip install -r requirements.txt` downloads and installs the attacker-influenced dependencies. Installation-t ...[truncated 1037 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the external repository to a reviewed, immutable commit SHA instead of relying solely on a mutable tag. 2. Verify the checked-out commit after cloning and abort installation if it does not match the approved SHA. 3. Pin every Python dependency to an exact version and use hashes, such as a lock file compatible with `pip install --require-hashes`. 4. Publish signed releases or checksums and require verification before installation or execution. 5. Review and vendor security-critical scripts in the Skill package where practical, so the executed implementation is covered by the same audit. 6. Install dependencies in a dedicated virtual environment or container using a non-root service account. 7. Restrict the service account's filesystem and outbound-network permissions to those required for the documented functionality. 8. Provide credentials only at runtime, grant them the narrowest available permissions, and keep them inaccessible to unrelated processes. 9. Perform dependency vulnerability and provenance scanning as part of release publication and deployment.