T03 · Remote Payload Retrieval and Execution
- Location
SKILL.md:182- Finding
Unverified Remote Installer Is Piped Directly into Bash
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 182
Vulnerability Type: Remote payload retrieval and execution
Risk Level: HighComplete Code Snippet:
bash # Install Foundry curl -L https://foundry.paradigm.xyz | bash foundryupTechnical Analysis
The installation instructions download content from a mutable external URL and pass it directly to Bash. The downloaded script is therefore executed before the user or Agent can inspect it.
HTTPS provides transport protection but does not guarantee that the returned script remains identical to the version reviewed with this Skill. The project does not pin a release or provide a checksum, signature-verification procedure, or local validation step. If the website, DNS, CDN, TLS termination infrastructure, or upstream publishing process is compromised, the response can be replaced with arbitrary shell commands.
Installing Foundry is relevant to the declared blockchain-development functionality, but immediate execution of unverified remote content is not the minimum privilege or least-risk method necessary to install that dependency.
Attack Path
- An attacker compromises or gains control over the installer endpoint or part of its delivery infrastructure.
- The attacker changes the response from
https://foundry.paradigm.xyzto a malicious shell payload. - A user or AI Agent follows the Skill's environment-preparation instructions.
curlretrieves the attacker-controlled response and streams it directly to Bash.- Bash executes the payload with the permissions of the invoking user or Agent.
- The payload can access resources available to that account, including project files, Agent configuration, environment variables, and locally stored wallet material.
Impact Assessment
Successful exploitation permits arbitrary command execution under the invoking account. The attacker could read or alter accessible source code and co ...[truncated 492 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not pipe downloaded content directly into a shell.
- Pin Foundry to a specific trusted release rather than retrieving a mutable installer without version constraints.
- Download the installer or release artifact to a local file first:
bash curl --fail --proto '=https' --tlsv1.2 \ --output foundry-installer.sh \ https://foundry.paradigm.xyz - Verify the downloaded artifact using a vendor-published cryptographic signature or SHA-256 checksum obtained through a separately trusted channel.
- Inspect the saved script before executing it, and clearly require explicit user approval.
- Prefer a trusted operating-system package manager or signed release artifacts where supported.
- Execute installation using an unprivileged account and restrict filesystem and credential access during installation.
- Avoid running the installation from an Agent session that contains wallet keys or other sensitive environment variables.
- Document the exact expected artifact version and verification value so that later changes to the remote response cannot silently alter the executed payload.