T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:242
- Finding
- Mutable Remote Installer Is Executed Directly Through a Shell Pipeline## Vulnerability Details **File Location**: `SKILL.md`, lines 242–247 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Vulnerable Code ```bash **Option 2: CDN installer (no Node.js, or npm unreachable)** curl -fsSL https://cloudcache.volccdn.com/ve/install.sh | sh # or wget -qO- https://cloudcache.volccdn.com/ve/install.sh | sh ``` ### Technical Analysis These commands pass a remotely downloaded installer directly to a shell. The effective script can change after the Skill has been reviewed, and it is executed before the user or Agent can inspect it or verify its integrity. The archive checksum verification implemented by the downloaded installer does not authenticate the installer itself. TLS reduces network interception risk but does not protect against compromise of the CDN, DNS infrastructure, release-publishing credentials, or the remote installer path. This behavior exceeds the minimum privileges necessary because the project already contains a reviewable installer at `scripts/install_ve.sh`. Executing an unaudited remote script is unnecessary when that bundled implementation can be used instead. ### Attack Path 1. An attacker compromises the CDN, publishing account, DNS resolution, or remote `install.sh` object. 2. The attacker replaces the installer with a modified shell script. 3. An Agent follows the documented fallback installation procedure. 4. `curl` or `wget` writes the attacker-controlled response directly to the shell. 5. The payload executes with all privileges available to the Agent process. 6. The payload can steal credentials, alter local files, install replacement tools, or establish persistence before installing a legitimate-looking `ve` binary. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account running the installation. If that account can write to `/usr/local/bin`, the attacker may als ...[truncated 420 chars]
- Remediation
- ## Remediation Suggestions 1. Remove both pipe-to-shell examples from `SKILL.md`. 2. Prefer the bundled, reviewable installer: ```bash sh scripts/install_ve.sh --version 1.1.9 ``` 3. If remote retrieval is unavoidable, download the installer to a file without executing it: ```bash curl -fsSLo install_ve.sh https://cloudcache.volccdn.com/ve/install.sh ``` 4. Verify the installer using a version-pinned checksum or cryptographic signature obtained through an independently trusted channel. 5. Inspect the verified script before invoking it with `sh`. 6. Pin the CLI version instead of automatically consuming a mutable `latest` pointer. 7. Document the expected installer digest and release provenance in the Skill.