T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:178
- Finding
- Unverified Remote Installer Download and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 178–180 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash curl -fsSL "https://raw.githubusercontent.com/redotpay/redotpay-cli/v0.1.0/install.sh" -o redotpay-install.sh shasum -a 256 -c SHA256SUMS --ignore-missing bash redotpay-install.sh ``` ### Technical Analysis The installation instructions download a shell script from an external, repository-controlled URL and execute it with `bash`. Consequently, the code ultimately executed is not contained in the audited Skill package and cannot be verified through review of this artifact. The apparent integrity check does not establish trust in the downloaded installer. `SHA256SUMS` is neither included in the project nor downloaded by the documented procedure. No expected digest for `redotpay-install.sh` is embedded in `SKILL.md`. In addition, `--ignore-missing` may skip checksum entries whose referenced files are absent. Even if an externally obtained checksum file were available, retrieving it from the same potentially compromised source as the installer would not provide an independent trust boundary. Referencing the `v0.1.0` Git tag does not provide cryptographic immutability. If the repository, hosting account, tag, or delivery path is compromised or altered, the effective installer payload may change after the Skill has been reviewed. This behavior exceeds the minimum privileges necessary for the declared service-discovery and data-retrieval workflow. Those functions require an available CLI, but they do not inherently require an Agent to execute an unaudited remote shell payload. ### Attack Path 1. A user invokes the Skill on a system where the `redotpay` CLI is unavailable. 2. The Agent or user follows the documented first-time installation procedure. 3. `curl` retrieves `install.sh` from the externally controlled repository endpoint. 4. The checksum command fails to ...[truncated 932 chars]
- Remediation
- ## Remediation Suggestions 1. Do not instruct the Agent to download and execute a mutable remote shell script. 2. Prefer a trusted operating-system package manager or reputable package registry with signed, versioned releases and reproducible provenance. 3. If a standalone installer is unavoidable, reference an immutable release artifact and place its exact SHA-256 digest directly in the audited Skill documentation. 4. Verify the specific installer before execution and terminate immediately on a mismatch. Do not use `--ignore-missing`. 5. Obtain signatures or checksums through an independent trusted channel rather than from the same location as the payload. 6. Vendor the reviewed installer into the Skill package where policy permits, allowing its contents to be audited together with the instructions. 7. Run installation with the least-privileged account required. Do not request administrator or root privileges unless a documented component strictly requires them. 8. Make installation an explicit user-controlled action rather than an automatic consequence of invoking the Skill. 9. After installation, verify the CLI version and, where supported, its package signature or binary digest before using it with wallet credentials.