T03 · Remote Payload Retrieval and Execution
Error
- Location
- scripts/init.py:20
- Finding
- Unpinned Remote Repository Is Retrieved and Executed During Setup<![CDATA[ ## Vulnerability Details **File Location**: `scripts/init.py:20`, `scripts/init.py:111-135`; setup is recommended in `SKILL.md:25-37` **Vulnerability Type**: Unverified remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```python SNOWVOICE_REPO = "https://github.com/webkubor/snowvoice-studio.git" ``` ```python # 2. 克隆仓库 if install_path.exists(): result["steps"].append(f"⏭ 目录已存在: {install_path}") else: code, _, err = run_cmd( ["git", "clone", SNOWVOICE_REPO, str(install_path)] ) if code != 0: result["message"] = f"克隆失败: {err}" return result result["steps"].append(f"✓ 克隆仓库完成") # 3. 运行 install.sh（会创建 venv、安装依赖、下载 Base 模型） install_script = install_path / "install.sh" if not install_script.exists(): result["message"] = f"install.sh 不存在: {install_script}" return result run_cmd(["chmod", "+x", str(install_script)]) # install.sh 会下载 Base-1.7B 模型 code, out, err = run_cmd( ["bash", str(install_script)], cwd=str(install_path), timeout=600, ) ``` ### Technical Analysis The setup process clones the mutable default branch of an external GitHub repository and immediately executes its `install.sh` script. It does not pin a reviewed commit or release, verify a cryptographic digest or signature, or inspect the retrieved script before execution. Consequently, the effective executable payload can change after this Skill has been audited. The trust check for an existing installation directory is also insufficient. When `~/.snowvoice-studio` already exists, cloning is skipped and the local `install.sh` is executed based only on its presence. The code does not verify that the directory is a Git repository from the expected upstream, that its revision is approved, or that the installer has the expected digest. Using a subprocess argument array prevents shell metacharacters in the repository URL from being interpreted locally, but it does not mitigate execution of malicious c ...[truncated 1836 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the upstream source to an immutable, reviewed commit hash rather than cloning and executing the mutable default branch. 2. Distribute an expected SHA-256 or stronger digest for `install.sh` and verify it before execution. Prefer a cryptographically signed release with verification against a pinned maintainer key. 3. Clone without executing code, explicitly check out the approved commit, and verify that `HEAD` exactly matches it: ```bash git clone --no-checkout <repository> <destination> git -C <destination> checkout --detach <approved-commit> test "$(git -C <destination> rev-parse HEAD)" = "<approved-commit>" ``` 4. Do not trust an installation merely because its directory and files exist. For pre-existing directories, validate the repository origin, exact commit, expected file digests, ownership, and permissions. Abort on any mismatch. 5. Vendor and audit the required installation logic where practical, or replace the general-purpose shell installer with explicit installation steps using version-pinned dependencies and hash verification. 6. Execute installation with the least privileges possible and clearly require user confirmation before running remotely sourced code. 7. Treat installer failure and timeout as failure. The current logic may report success after a nonzero installer result or timeout, which can leave an unverified partial installation available for later use. ]]>