T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:4
- Finding
- Mutable Remote Executable Is Downloaded and Trusted Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:4`; corroborating manual installation instructions at `README.md:39-49` **Vulnerability Type**: Remote payload retrieval and execution through an unpinned external executable **Risk Level**: High ### Vulnerable Code `SKILL.md:4`: ```json metadata: {"clawdbot":{"emoji":"✅","requires":{"bins":["todo","curl","jq"],"env":["TASKLEEF_API_KEY"]},"primaryEnv":"TASKLEEF_API_KEY","homepage":"https://taskleef.com","install":[{"id":"todo-cli","kind":"download","url":"https://raw.githubusercontent.com/Xatter/taskleef/main/taskleef-cli/todo","bins":["todo"],"label":"Install Taskleef CLI (todo)"},{"id":"jq-brew","kind":"brew","formula":"jq","bins":["jq"],"label":"Install jq via Homebrew","os":["darwin"]},{"id":"jq-linux-amd64","kind":"download","url":"https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux-amd64","bins":["jq"],"label":"Install jq (Linux x86_64)","os":["linux"]},{"id":"jq-linux-arm64","kind":"download","url":"https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux-arm64","bins":["jq"],"label":"Install jq (Linux ARM64)","os":["linux"]}]}} ``` `README.md:39-49`: ```bash **todo CLI:** ```bash # Clone the repository git clone https://github.com/Xatter/taskleef.git cd taskleef/taskleef-cli chmod +x todo # Add to PATH (add to ~/.bashrc or ~/.zshrc) export PATH="$PATH:/path/to/taskleef/taskleef-cli" ``` ``` ### Technical Analysis The automatic installer downloads the `todo` executable directly from the mutable `main` branch of an external GitHub repository. The configuration does not pin the executable to an immutable commit or version and does not provide a checksum or cryptographic signature for integrity verification. Consequently, the effective executable payload can change after this Skill has been audited. The package contains no local source for the downloaded CLI, so its runtime behavior cannot be verified from the audited project. The manual installation instructions h ...[truncated 2271 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Pin the CLI to immutable content** - Reference an immutable release artifact or exact Git commit rather than the `main` branch. - Avoid URLs whose contents can change without changing the Skill metadata. 2. **Verify integrity before execution** - Publish a SHA-256 or stronger digest for every supported artifact. - Configure the installer to reject any artifact whose digest does not exactly match the reviewed value. - Prefer cryptographically signed release artifacts and verify signatures against a pinned, trusted public key. 3. **Vendor or build reviewed source** - Include the reviewed CLI source in the Skill package where feasible. - Use a reproducible build process so the installed binary can be matched to audited source. - Record the upstream version, commit identifier, build procedure, and expected digest. 4. **Apply least privilege** - Run the CLI with only the environment variables, filesystem paths, and network access required for Taskleef operation. - Do not expose unrelated secrets to the CLI process. - Avoid running the Skill or installer as root or another privileged account. 5. **Harden the manual installation documentation** - Replace the unpinned `git clone` procedure with checkout of a reviewed commit or signed tag. - Add explicit checksum or signature-verification commands before `chmod +x` or execution. 6. **Review the external CLI** - Add the pinned `todo` implementation to the audit scope. - Verify credential handling, command construction, TLS behavior, temporary-file handling, and API response parsing before trusting the executable. ]]>