T03 · Remote Payload Retrieval and Execution
Error
- Location
- scripts/setup_brave_shim.py:6
- Finding
- Unpinned Remote Repository Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup_brave_shim.py:6-7, 18-22`; `scripts/start_shim.py:10-22` **Vulnerability Type**: Remote mutable payload retrieval and execution **Risk Level**: High ### Complete Code Snippet From `scripts/setup_brave_shim.py`: ```python REPO_URL = "https://github.com/asoraruf/brave_shim" DEST = os.path.join(os.path.dirname(__file__), "..", "brave_shim_repo") VENV_DIR = os.path.join(DEST, "venv") def run(cmd, check=True, **kwargs): print(f"Running: {cmd}") r = subprocess.run(cmd, shell=True, **kwargs) if check and r.returncode != 0: sys.exit(f"Failed: {cmd}") return r def main(): # Clone if os.path.exists(DEST): print(f"Already exists at {DEST}, skipping clone") else: run(f'git clone {REPO_URL} "{DEST}"') ``` From `scripts/start_shim.py`: ```python def main(): shim_path = sys.argv[1] if len(sys.argv) > 1 else DEFAULT_SHIM if not os.path.exists(shim_path): print(f"brave_shim.py not found at {shim_path}") print("Run scripts/setup_brave_shim.py first, or pass path as argument") sys.exit(1) venv_python = os.path.join(os.path.dirname(shim_path), "venv", "Scripts" if sys.platform == "win32" else "bin", "python") if not os.path.exists(venv_python): venv_python = "python" # fallback to system python print(f"Starting brave_shim from {shim_path}...") subprocess.run(f'"{venv_python}" "{shim_path}"', shell=True) ``` ### Technical Analysis The setup script clones the current state of a third-party GitHub repository without selecting an immutable commit or verifying a cryptographic digest or signature. The start script subsequently executes `brave_shim.py` from that clone. Consequently, the effective code executed by the Skill can change after the Skill itself has been reviewed. The downloaded source is not present in the audited project, so its behavior—including handling of search queries, credentials, H ...[truncated 1492 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor the reviewed shim source into the Skill so the audited code is the code that executes. 2. If remote retrieval is unavoidable, pin an immutable full commit hash and verify the checked-out commit before execution. 3. Publish and verify a cryptographic checksum or signed release artifact using a trusted signing key. 4. Display the exact source revision and obtain explicit user approval before execution. 5. Run the shim with a dedicated, low-privilege account or sandbox that has no access to unrelated files, secrets, or administrative interfaces. 6. Replace shell command strings with argument arrays and disable shell processing: ```python subprocess.run( ["git", "clone", "--no-checkout", REPO_URL, DEST], check=True, ) subprocess.run( [venv_python, shim_path], check=True, shell=False, ) ``` 7. Validate any user-supplied shim path, require it to resolve inside an approved directory, and reject symbolic-link escapes. ]]>