T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/env_init.sh:31- Finding
Unverified Remote SDK Download and Execution
- Content
View full analysis
/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' || echo "0.0.0") remote_ver=$(echo "$manifest" | jq -r '.sdk_version // "unknown"') if [ "$local_ver" = "0.0.0" ] || [ "$local_ver" != "$remote_ver" ]; then echo "📦 SDK 更新: $local_ver → $remote_ver，正在安装..." pip install --quiet --upgrade https://las-ai-cn-beijing-online.tos-cn-beijing.volces.com/operator_cards_serving/public/skills/sdk/las_sdk-0.2.0-py3-none-any.whl fi ``` The installation is also made a mandatory initialization step by `SKILL.md:59-67`. ### Technical Analysis The initialization script retrieves a mutable remote manifest and installs a Python wheel directly from an object-storage URL. The downloaded wheel is not validated using a pinned cryptographic hash, package signature, trusted lockfile, or equivalent integrity control. HTTPS protects the package in transit but does not establish that the current remote artifact is identical to the artifact reviewed with the skill. If the storage account, publication pipeline, DNS resolution, certificate trust chain, or artifact itself is compromised, the effective code executed by the skill can change after review. The manifest's reported version determines whether installation occurs, but the wheel URL is hardcoded to version `0.2.0`. Consequently, a missing, malformed, or mismatched manifest version can trigger installation even when the manifest does not identify the exact artifact being installed. Python package installation and subsequent imports may execute package-controlled code. The inst ...[truncated 1501 chars]- Remediation
View remediation
" SDK_FILE="$(mktemp)" curl --fail --proto '=https' --tlsv1.2 --location \ --output "$SDK_FILE" "$SDK_URL" echo "${SDK_SHA256} ${SDK_FILE}" | sha256sum --check --status || { echo "SDK integrity verification failed" >&2 rm -f "$SDK_FILE" return 1 2>/dev/null || exit 1 } python -m pip install --no-deps "$SDK_FILE" rm -f "$SDK_FILE" ``` 3. Prefer a signed package repository or verify a detached artifact signature against a pinned public key. 4. Ensure the manifest identifies the exact wheel version and digest. Reject unknown or malformed manifest values instead of falling back to an installation-triggering state. 5. Do not perform automatic updates during routine skill execution. Require explicit administrator or user approval before changing executable dependencies. 6. Use a lockfile with hashes for all transitive dependencies. 7. Run dependency installation and document processing in a restricted environment with minimal filesystem access, no unnecessary credentials, and constrained outbound network access. 8. Log the resolved package version and verified digest to support incident response and reproducible audits. ]]>