T03 · Remote Payload Retrieval and Execution
Error
- Location
- scripts/update-skill.sh:72
- Finding
- Unauthenticated Remote Replacement of Executable Skill Code<![CDATA[ ## Vulnerability Details **File Location**: `scripts/update-skill.sh:72-79`, `scripts/update-skill.sh:99-114` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash # Resolve GitHub token (explicit env var, or from gh CLI) GH_TOKEN="${GITHUB_TOKEN:-$(gh auth token 2>/dev/null || echo "")}" REMOTE_SHA=$(curl -sf \ -H "Accept: application/vnd.github.v3+json" \ -H "Authorization: Bearer $GH_TOKEN" \ "https://api.github.com/repos/fdarkaou/genviral-skill/commits/$REMOTE_BRANCH" \ | jq -r '.sha' 2>/dev/null || echo "") ``` ```bash for FILE in "${SKILL_OWNED_FILES[@]}"; do RAW_URL="https://raw.githubusercontent.com/fdarkaou/genviral-skill/$REMOTE_SHA/$FILE" TARGET="$SKILL_DIR/$FILE" if [[ "$DRY_RUN" == "true" ]]; then echo "[DRY RUN] Would update: $FILE" continue fi # Fetch and write atomically TMPFILE=$(mktemp) if curl -sf "$RAW_URL" -o "$TMPFILE"; then mkdir -p "$(dirname "$TARGET")" mv "$TMPFILE" "$TARGET" # Make scripts executable [[ "$FILE" == scripts/* ]] && chmod +x "$TARGET" ``` ### Technical Analysis The updater obtains the latest commit identifier from the upstream repository's mutable `main` branch and then downloads files from that commit. It overwrites local executable scripts, documentation, and `SKILL.md`, and explicitly marks downloaded scripts as executable. Using the remotely returned commit SHA ensures that all downloaded files come from one commit, but it does not establish that the commit is an authorized, reviewed release. There is no locally pinned expected commit, signed-release verification, trusted-key validation, or hash manifest independent of the same upstream repository. The files subject to replacement include `scripts/genviral.sh`, `scripts/update-skill.sh`, and `SKILL.md`. Consequently, the remotely supplied payload can alter both locally executed shell code and the instructions subsequently loaded by the AI a ...[truncated 1372 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove unattended replacement of executable scripts and `SKILL.md`. 2. Require explicit user approval before downloading or applying an update. 3. Update only from immutable, reviewed releases rather than the mutable `main` branch. 4. Verify a signed release or signed commit against a locally configured trusted maintainer key. 5. Maintain an independently distributed or locally pinned manifest containing the expected SHA-256 digest of every updated file. 6. Download updates into a staging directory and present the file list, hashes, and diffs for review. 7. Refuse partial updates if any expected file is missing or fails verification. 8. Apply all files atomically only after every signature and hash has been validated. 9. Do not automatically mark newly downloaded content executable until verification succeeds. 10. Run update operations with a restricted environment that does not expose `GENVIRAL_API_KEY` or unrelated credentials. ]]>