T03 · Remote Payload Retrieval and Execution
- Location
scripts/env_init.sh:31- Finding
Automatic Installation of an Unverified Remote Python Wheel
- Content
View full analysis
Vulnerability Details
File Location:
scripts/env_init.sh, lines 31–41
Vulnerability Type: Remote supply-chain code execution through an unverified dependency
Risk Level: Highbash # 2. 获取远程 manifest manifest_url="https://las-ai-cn-beijing-online.tos-cn-beijing.volces.com/operator_cards_serving/public/skills/sdk/manifest.json" manifest=$(curl -sf "$manifest_url" || echo '{}') # 3. 比较 SDK 版本并自动更新 local_ver=$(lasutil --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' || echo "0.0.0") remote_ver=$(echo "$manifest" | jq -r '.sdk_version // "unknown"') if [ "$local_ver" = "0.0.0" ] || [ "$local_ver" != "$remote_ver" ]; then echo "📦 SDK 更新: $local_ver → $remote_ver，正在安装..." pip install --quiet --upgrade https://las-ai-cn-beijing-online.tos-cn-beijing.volces.com/operator_cards_serving/public/skills/sdk/las_sdk-0.2.0-py3-none-any.whl fiTechnical Analysis
The mandatory initialization workflow downloads and installs a Python wheel from a mutable external object-storage URL. The script does not verify a cryptographic hash, a package signature, or another locally pinned integrity value before invoking
pip install.The remote manifest controls whether the update branch executes, but the manifest itself is also fetched remotely without content authentication beyond ordinary TLS. Furthermore, a manifest retrieval failure is converted into
{}, which producesremote_ver="unknown". Unless the local version is also reported asunknown, this state can trigger installation rather than failing closed.Although the dependency has a versioned filename and comes from a domain apparently associated with the declared service, the reviewed project does not establish the integrity of its contents. Whoever can replace or maliciously publish the referenced wheel can change the effective code executed after this skill has passed review.
Attack Path
- An agent follows the mandatory initialization instructions in
SKILL.mdand sourc ...[truncated 1465 chars]
- An agent follows the mandatory initialization instructions in
- Remediation
View remediation
Remediation Suggestions
-
Pin and verify the artifact
- Record an independently reviewed SHA-256 digest in the repository.
- Download the wheel as a separate step and verify its digest before installation.
- Abort installation if verification fails.
-
Use a locked dependency definition
- Prefer an authenticated package repository and a lock file containing exact versions and hashes.
- Install with hash enforcement, such as
pip install --require-hashes. - Do not rely solely on a version embedded in a mutable URL.
-
Fail closed
- If the manifest cannot be retrieved or validated, retain the reviewed local version or stop with a clear error.
- Do not map retrieval failures to a value that triggers an automatic update.
-
Remove implicit updates from mandatory initialization
- Separate environment activation from dependency updates.
- Require explicit user or administrator approval before downloading or changing executable dependencies.
-
Reduce exposure during installation
- Perform dependency installation in a restricted build environment without cloud credentials.
- Run the resulting package with least privilege and only the environment variables required for the operation.
-
Strengthen provenance controls
- Use signed release artifacts and verify signatures against a pinned trusted key.
- Make dependency versions and integrity metadata part of the reviewed skill package.
-