T03 · Remote Payload Retrieval and Execution
- Location
hooks/postinstall.py:57- Finding
Automatic Installation of an Unpinned and Unverified Remote Code Package
- Content
View full analysis
Vulnerability Details
File Location:
hooks/postinstall.py:57-58, 80-91, 110-128
Vulnerability Type: Unverified remote payload retrieval and installation
Risk Level: HighVulnerable Code
python def get_privileged_url() -> str: """获取私有包 URL""" return "https://cnb.cool/llm-memory-integrat/llm.git"python try: # 如果目标目录已存在，先删除 if target_dir.exists(): log(f"目标目录已存在，删除旧版本...") shutil.rmtree(target_dir) # 克隆仓库 result = subprocess.run( ["git", "clone", "--depth", "1", url, str(target_dir)], capture_output=True, text=True, timeout=120 ) if result.returncode != 0: log(f"克隆失败: {result.stderr}", "ERROR") return False log(f"克隆成功！") return Truepython def verify_privileged_package(target_dir: Path) -> bool: """ 验证私有包完整性 Args: target_dir: 私有包目录 Returns: bool: 是否有效 """ required_files = [ "README.md", "hybrid_memory_search.py", "smart_memory_update.py" ] for file in required_files: if not (target_dir / file).exists(): log(f"缺少必需文件: {file}", "WARN") return False log("私有包验证通过") return TrueTechnical Analysis
The post-installation lifecycle hook automatically clones the current default branch of an external private repository into
src/privileged. The clone is not pinned to an immutable commit or signed release. Consequently, the code installed for two users—or for the same user at different times—can differ even though the reviewed public Skill package has not changed.The integrity check only confirms that three expected filenames exist. It does not verify file hashes, a signed manifest, a trusted Git commit, repository ownership, or the contents of any Python or ...[truncated 2746 chars]
- Remediation
View remediation
Remediation Suggestions
-
Avoid post-review code retrieval
- Package and audit all required implementation files as part of the published Skill.
- Do not automatically install executable remote content during a lifecycle hook.
-
Pin an immutable artifact
- If remote retrieval is unavoidable, pin a specific full Git commit hash rather than cloning the mutable default branch.
- Prefer a versioned, immutable release artifact over a shallow branch clone.
-
Perform cryptographic verification
- Publish a signed manifest containing a hash for every downloaded file.
- Verify the manifest with a trusted publisher public key embedded in the reviewed package.
- Reject and remove the payload if signature, commit, or hash validation fails.
- Do not treat filename existence as integrity verification.
-
Require explicit user consent
- Disable remote package installation by default.
- Present the exact source, version, commit hash, permissions, native-code status, and integrity information before download.
- Require a separate explicit action to install or activate the privileged implementation.
-
Use safe installation semantics
- Download into a newly created staging directory.
- Verify the complete staged package before replacing an existing installation.
- Atomically move the verified directory into place.
- Preserve the previous trusted version if retrieval or verification fails.
-
Restrict runtime exposure
- Keep downloaded code outside automatically importable package paths until verification and activation are complete.
- Run privileged or native components in a sandbox with minimal filesystem, credential, subprocess, and network permissions.
-
Correct security metadata
- Declare that the optional package contains executable code and may contain native extensions.
- Clearly distinguish the reviewed public package from the s ...[truncated 41 chars]
-