T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:13
- Finding
- Unverified Remote Script Is Executed Directly by Bash## Vulnerability Details **File Location**: `SKILL.md`, lines 13–19 and 120–123 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```yaml "install": [ { "id": "hyperspace-cli", "kind": "bash", "command": "curl -fsSL https://agents.hyper.space/cli | bash", "bins": ["hyperspace"], "label": "Install Hyperspace Network Node", }, ], ``` The same unsafe installation mechanism is repeated in the user-facing instructions: ```bash curl -fsSL https://agents.hyper.space/cli | bash ``` ### Technical Analysis The Skill downloads a mutable response from `https://agents.hyper.space/cli` and pipes it directly into Bash. The payload is executed before the user or Agent can inspect it. No fixed release version, expected checksum, cryptographic signature, or immutable artifact URL is specified. Although `SKILL.md` links to a public GitHub installation script, the executed URL is a separate endpoint. The reviewed project provides no mechanism proving that the endpoint serves the same script as the linked GitHub source. HTTPS protects the connection in transit but does not protect against compromise of the server, DNS or hosting account, deployment pipeline, or upstream release infrastructure. The remote response receives all permissions available to the invoking process. Consequently, its effective behavior can change after this Skill has been reviewed without any modification to the local Skill package. ### Attack Path 1. An attacker compromises the remote installer endpoint, its hosting infrastructure, or its deployment credentials. 2. The attacker replaces the expected response with a malicious shell script. 3. A user or Agent invokes the documented installation command. 4. `curl` retrieves the attacker-controlled response. 5. The pipe passes the response directly to Bash without inspection or integrity validati ...[truncated 932 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all `curl | bash` installation instructions and automated installation metadata. 2. Publish versioned artifacts through an official release mechanism and use an immutable version URL. 3. Download the artifact to a local file rather than executing a network stream. 4. Publish an expected SHA-256 or stronger digest through an independently protected channel and verify it before execution. 5. Cryptographically sign releases and verify the signature against a documented, pinned publisher key. 6. Display the resolved version, source URL, checksum, requested changes, and destination paths before asking for explicit installation consent. 7. Execute installation with the least-privileged account possible and avoid recommending elevated privileges unless a specific operation requires them. 8. Keep the installer source in the reviewed repository and ensure the distributed artifact is reproducibly tied to that source. 9. Fail closed if signature or checksum validation cannot be completed.