T03 · Remote Payload Retrieval and Execution
Error
- Location
references/command-library.md:69- Finding
Unverified Remote Shell Scripts Are Downloaded and Executed Directly
- Content
View full analysis
- Remediation
View remediation
Security audit
hap-upgrade
Security checks for vulnerabilities and agentic risk
Overview
This skill is for legitimate HAP upgrade guidance, but it may tell administrators to run unverified remote scripts on production infrastructure.
Review generated upgrade guides carefully before use. Do not run the included remote script one-liners on production hosts or Kubernetes control nodes unless you first download the script, verify its integrity from a trusted source, inspect it, and run it with the minimum required privileges. Replace placeholder/default passwords and avoid putting real credentials directly in shell history or shared runbooks.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (16)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill metadata and content are written exclusively in Chinese and the description strongly implies this skill should be used whenever HAP upgrade topics arise, without accommodating the user's preferred language. This can degrade user comprehension, increase the chance of operational mistakes during sensitive upgrade procedures, and reduce the user's ability to verify safety-critical instructions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The template instructs operators to execute a shell script fetched directly from the network via curl and pipe it into bash, which removes any opportunity to inspect, verify, or pin the content before execution. In an upgrade skill, this is especially dangerous because users are likely to run it on privileged control nodes, so a compromised hosting endpoint, MITM, or replaced script could lead to immediate remote code execution and cluster compromise.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The guide instructs operators to execute a script fetched directly from the network via
curl ... | bash, which creates a classic remote code execution and supply-chain risk. In an upgrade skill, this is especially dangerous because users are likely to run the command on production servers with elevated privileges, making compromise of the hosting endpoint, DNS, TLS trust, or distribution path highly impactful.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document normalizes passing database credentials directly on the command line (
-p123456), which can expose secrets through shell history, process listings, screenshots, copied logs, and operational habits. In a production upgrade context, encouraging plaintext examples increases the chance that administrators reuse insecure invocation patterns with real credentials on sensitive systems.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The command pipes a remotely fetched script directly into bash, causing immediate execution of network-delivered code without prior integrity verification, review, or a user-facing warning. In an upgrade skill, users are likely to run commands with elevated privileges on production systems, so a compromised host, CDN, DNS path, or publishing pipeline could lead to full server compromise or destructive changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This cluster variant has the same unsafe pattern: a remote script is fetched and executed immediately in a Kubernetes-related context, where compromise can affect multiple services or nodes. Because the skill is specifically for private-deployment upgrades, operators may treat these commands as authoritative and run them on sensitive infrastructure, amplifying the blast radius of any upstream or man-in-the-middle compromise.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The template includes sed -i commands that perform in-place modification of deployment YAML and update scripts, which can irreversibly alter production configuration if run against the wrong path or with unexpected file contents. Although intended as a legitimate upgrade step, the lack of a strong warning, backup instruction, or validation step increases the risk of accidental service misconfiguration or outage.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
All user-facing instructions are presented only in Chinese, and the file does not indicate that the language is optional, user-selected, or limited to a justified region-specific context. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The entire skill guidance is written in Chinese and does not indicate any option to use another language or locale. Under the stated policy, a skill that effectively enforces a specific language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The document states '语言：中文（默认）/ 英文' and requires an '/en/' prefix for English, which establishes a default locale preference in natural language. Under the policy rule, forcing a specific language without user opt-in can be a locale-policy violation unless clearly justified.
- Content
Static analysis
No suspicious patterns detected.