T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:43
- Finding
- Mutable Remote Source Is Retrieved, Built, and Installed Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:43` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```yaml command: "cd /tmp && git clone https://github.com/TigerPassNet/tigerpass-cli.git && cd tigerpass-cli && make release && sudo cp .build/release/TigerPass /usr/local/bin/tigerpass" ``` ### Technical Analysis The source installation retrieves the mutable default branch of an external Git repository and immediately runs its build process. It does not pin an immutable commit or release tag, verify a cryptographic signature, or validate a checksum. The effective code executed by `make release` can therefore change after this Skill has been reviewed. Repository-controlled build files and scripts execute with the installing user's privileges. The resulting binary is then copied into `/usr/local/bin/tigerpass` using `sudo`, replacing or introducing a system-wide command used for wallet signing and financial transactions. Although `sudo` is applied specifically to the copy operation rather than the entire build, it allows the unverified artifact to be installed into a privileged executable location. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or the upstream development pipeline. 2. The attacker modifies the default branch, build scripts, or source used to produce the TigerPass binary. 3. A user or agent follows the documented source installation command. 4. `git clone` retrieves the attacker-controlled revision. 5. `make release` executes malicious build-time code with the installing user's privileges. 6. The attacker-controlled binary is copied to `/usr/local/bin/tigerpass`. 7. Subsequent wallet, signing, trading, bridging, or smart-contract commands run through the substituted binary. ### Impact Assessment A successful compromise can provide arbitrary code execution with the ...[truncated 521 chars]
- Remediation
- ## Remediation Suggestions - Pin the installation to a specific audited release tag and immutable commit hash. - Verify that the tag is cryptographically signed by an authorized release key. - Publish and validate a SHA-256 checksum or signed provenance record for the source and compiled artifact. - Build in a sandbox or isolated environment with restricted filesystem and network access. - Review repository build scripts before running `make release`. - Prefer reproducible builds so users can compare the locally produced binary with an independently verified release. - Install into a user-controlled directory where possible instead of invoking `sudo`. - If system-wide installation is necessary, verify the final artifact immediately before the privileged copy operation.