T03 · Remote Payload Retrieval and Execution
Warning
- Location
- SKILL.md:62
- Finding
- Mutable Remote Source Repositories Are Built and Installed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:62-76`, `SKILL.md:91-106`, and `SKILL.md:121-142` **Vulnerability Type**: Remote source execution and insecure software supply chain **Risk Level**: Medium Equivalent instructions also appear in `README.md:66-100` and `README_zh.md:64-98`. ### Vulnerable Code ```bash mkdir -p ~/flagos-workspace && cd ~/flagos-workspace git clone https://github.com/flagos-ai/vllm-plugin-FL ``` ```bash cd vllm-plugin-FL pip install -r requirements.txt pip install --no-build-isolation . ``` ```bash # Install build dependencies pip install -U scikit-build-core==0.11 pybind11 ninja cmake # Clone FlagGems source code cd ~/flagos-workspace git clone https://github.com/flagos-ai/FlagGems ``` ```bash cd FlagGems pip install --no-build-isolation . ``` ```bash cd ~/flagos-workspace git clone https://github.com/flagos-ai/FlagCX.git ``` ```bash cd FlagCX git submodule update --init --recursive # Build for your platform (e.g. USE_NVIDIA=1 for NVIDIA) make USE_NVIDIA=1 export FLAGCX_PATH="$PWD" # Install Python binding (replace [xxx] with your platform: nvidia, ascend, etc.) cd plugin/torch/ FLAGCX_ADAPTOR=[xxx] pip install --no-build-isolation . ``` ### Technical Analysis The installation workflow clones the current state of several remote repositories and immediately executes their dependency installers, Python build hooks, native build files, and recursively retrieved submodules. None of the repositories or submodules is pinned to a reviewed commit hash or authenticated release artifact. Consequently, the effective code executed by the Skill can change after the Skill itself has been audited. Relevant execution surfaces include: - Python package build backends invoked by `pip install`. - Dependencies dynamically resolved from `requirements.txt`. - Native commands and compiler invocations controlled by `Makefile`. - Arbitrary repositories referenced by recursively initialized Git submodules. - Runtime module i ...[truncated 2076 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every cloned repository to an immutable, reviewed commit: ```bash git clone --filter=blob:none https://github.com/flagos-ai/vllm-plugin-FL cd vllm-plugin-FL git checkout --detach <reviewed-commit-sha> test "$(git rev-parse HEAD)" = "<reviewed-commit-sha>" ``` 2. Pin every submodule to an expected commit and validate submodule URLs before initialization. Avoid unrestricted recursive initialization where possible. 3. Prefer signed release tags or release artifacts and verify signatures or published SHA-256 checksums before installation. 4. Replace unconstrained dependency installation with a reviewed lock file containing exact versions and hashes: ```bash python -m pip install --require-hashes -r requirements.lock ``` 5. Review `pyproject.toml`, `setup.py`, build backend configuration, `Makefile`, and submodule metadata before executing installation commands. 6. Run installation in a dedicated virtual environment or disposable container under an unprivileged account. Do not run the workflow as root. 7. Restrict filesystem mounts, credentials, SSH agents, cloud metadata access, and network access available to build processes. 8. Separate retrieval, verification, build, and installation into explicit stages so that no fetched content is executed before integrity validation. ]]>