T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/env_init.sh:31- Finding
Unverified Remote SDK Retrieval and Installation
- Content
View full analysis
/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' || echo "0.0.0") remote_ver=$(echo "$manifest" | jq -r '.sdk_version // "unknown"') if [ "$local_ver" = "0.0.0" ] || [ "$local_ver" != "$remote_ver" ]; then echo "📦 SDK 更新: $local_ver → $remote_ver，正在安装..." pip install --quiet --upgrade https://las-ai-cn-beijing-online.tos-cn-beijing.volces.com/operator_cards_serving/public/skills/sdk/las_sdk-0.2.0-py3-none-any.whl fi ``` ### Technical Analysis The initialization script retrieves a mutable remote manifest and automatically installs a Python wheel from an external URL. Neither the manifest nor the wheel is verified against a pinned cryptographic digest or trusted signature. HTTPS protects the connection in transit but does not guarantee that the artifact stored at the URL remains identical to the artifact reviewed with the Skill. If the hosting account, storage object, DNS path, TLS trust chain, or release process is compromised, the wheel can be replaced without changing this repository. A malicious wheel can install executable modules, command entry points, or Python startup files. The installed `lasutil` package is subsequently invoked by the Skill, allowing the remotely supplied implementation to execute with the privileges of the user or Agent running the initialization. The manifest can also force repeated installation because its unverified `sdk_version` value controls whether the update branch executes. ### Attack Path 1. An attacker compromises or gains unauthorized write access to the remot ...[truncated 1162 chars]- Remediation
View remediation