T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:17
- Finding
- Unverified Remote Installer Executed Directly by Bash<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash curl https://cursor.com/install -fsS | bash ``` ### Technical Analysis The installation command retrieves a mutable script from an external URL and pipes it directly into Bash. The script is executed without version pinning, checksum validation, digital-signature verification, or an opportunity for local inspection. HTTPS protects the connection in transit but does not guarantee that the script currently hosted at the endpoint is the same script that existed when this Skill was reviewed. Compromise of the distribution endpoint, hosting infrastructure, DNS or certificate trust chain, or the publisher's deployment process could therefore convert this instruction into arbitrary code execution. Installing the Cursor CLI is consistent with the Skill's declared purpose. However, immediate execution of unverified network content exceeds the minimum mechanism required to install it. A pinned package or separately downloaded and verified installer can provide the same functionality with a smaller trust boundary. ### Attack Path 1. An attacker compromises the installer endpoint or another part of its delivery infrastructure. 2. The attacker replaces or modifies the remotely served installation script. 3. A user follows the documented command in `SKILL.md`. 4. `curl` downloads the attacker's current payload. 5. The shell executes the payload immediately without integrity verification or inspection. 6. The payload performs actions using the invoking user's permissions and may download additional components. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running the installation command. This can expose accessible credentials, API keys, source repositories, shell configuration, and user files. It can also mo ...[truncated 334 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer a version-pinned package distributed through an official package manager. 2. If a shell installer is unavoidable, download it without executing it: ```bash curl -fSLo cursor-install.sh https://cursor.com/install ``` 3. Obtain a publisher-provided checksum or signature through an independently authenticated release channel. 4. Verify the checksum or signature before execution. 5. Inspect the downloaded script and run it only with the minimum necessary user privileges. 6. Pin a specific installer release or immutable artifact instead of relying on a mutable generic URL. 7. Document the files, network access, and configuration changes that the installer is expected to make. 8. Do not recommend running the installer with `sudo` unless a specific operation demonstrably requires elevated privileges. ]]>