T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:79
- Finding
- Mutable Remote Repository Content Can Be Executed with Elevated Privileges<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 79–104 **Vulnerability Type**: Remote payload retrieval and execution through a configurable repository **Risk Level**: High ### Vulnerable Code ```bash After fetching, execute the tool's installation script (if configured): ```bash gettool pcl -i gettool pcl -i --global-install-flag true # Use sudo make install ``` ### 7. Fetch Specific Version Check out a specific version/tag/branch (only works for tools that are submodules): ```bash gettool fmt -v 9.1.0 ``` ### 8. Manage Repository URL ```bash # Show current URL gettool --get-url # Set custom URL gettool --set-url <URL> # Reset to default URL gettool --reset-url ``` ``` ### Technical Analysis The documented workflow allows the source repository to be changed to a user-supplied URL and then permits fetched content to be built or installed. The installation mode executes a tool-specific installation script, while `--global-install-flag true` enables `sudo make install`. No controls are documented for: - Restricting repositories to trusted hosts or an approved allowlist. - Pinning downloads to immutable commit hashes. - Verifying cryptographic signatures or expected checksums. - Reviewing fetched build and installation scripts before execution. - Isolating builds in a sandbox. - Preventing downloaded installation logic from executing with root privileges. Consequently, the effective executable payload can change after this Skill has been reviewed. An attacker-controlled or compromised repository could provide malicious `CMakeLists.txt`, Makefiles, source-level build hooks, or installation scripts. Invoking the documented build or installation operations would then execute those instructions locally. Although version selection is supported, tags and branches are mutable references unless resolved and verified against an immutable commit. Version selection alone therefore does not establish source integrity. ### Attack Path ...[truncated 1508 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Restrict remote sources** - Permit only explicitly approved HTTPS repository hosts and paths. - Reject local paths, insecure protocols, unexpected redirects, and arbitrary repository URLs. - Require a separate, explicit administrative action to modify the trusted repository configuration. 2. **Pin and verify fetched content** - Resolve every dependency to an immutable commit hash. - Maintain expected hashes or signed manifests for approved tools. - Verify Git commit or tag signatures against trusted keys before building. - Treat branches and unsigned tags as untrusted mutable references. 3. **Remove automatic privileged installation** - Do not invoke `sudo` from downloaded build or installation logic. - Stage installation artifacts in an unprivileged temporary destination. - Display the resulting file manifest and require explicit user approval before a separate trusted component performs system-wide installation. 4. **Sandbox build and installation steps** - Run downloaded build logic in an isolated container or restricted worker. - Use an unprivileged account with a read-only host filesystem. - Disable unnecessary network access during builds. - Do not expose SSH keys, API tokens, package-manager credentials, or unrelated source directories. 5. **Validate installation behavior** - Require installation scripts and build files to pass manual or automated review before execution. - Enforce destination-path restrictions and reject writes outside the approved staging directory. - Record the source URL, immutable revision, verification result, executed commands, and installed files in an audit log. 6. **Add explicit safety prompts** - Warn that build systems and installation scripts are executable code. - Require confirmation that identifies the exact trusted repository and immutable revision. - Require additional confirmation before any system-wide operation. ] ...[truncated 2 chars]