T03 · Remote Payload Retrieval and Execution
Warning
- Location
- scripts/main.py:61
- Finding
- Unpinned Remote Repository Content Can Be Installed and Executed<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/main.py:15` - `scripts/main.py:22-23` - `scripts/main.py:61-67` - `scripts/cli.sh:25-29` - `scripts/cli_anything.py:29-37` **Vulnerability Type**: Mutable remote payload retrieval followed by package installation **Risk Level**: Medium ### Vulnerable Code `scripts/main.py:15` ```python CLI_ANYTHING_REPO = "https://github.com/HKUDS/CLI-Anything.git" ``` `scripts/main.py:22-23` ```python print(f"📥 克隆 CLI-Anything 仓库...") subprocess.run(["git", "clone", CLI_ANYTHING_REPO, str(INSTALL_DIR)], check=True) ``` `scripts/main.py:61-67` ```python result = subprocess.run( ["pip", "install", "-e", "."], cwd=harness_dir, capture_output=True, text=True ) ``` `scripts/cli.sh:25-29` ```bash if [ ! -d "$CLI_ANYTHING_DIR" ]; then log_info "正在克隆 CLI-Anything 仓库..." git clone https://github.com/HKUDS/CLI-Anything.git "$CLI_ANYTHING_DIR" else log_info "更新 CLI-Anything 仓库..." cd "$CLI_ANYTHING_DIR" && git pull fi ``` `scripts/cli_anything.py:29-37` ```python if DEFAULT_CLONE_DIR.exists(): print(f"📂 CLI-Anything 已存在于 {DEFAULT_CLONE_DIR}") # 更新 os.chdir(DEFAULT_CLONE_DIR) run_command(["git", "pull"]) else: print(f"📥 克隆 CLI-Anything 仓库...") run_command(["git", "clone", CLI_ANYTHING_REPO, str(DEFAULT_CLONE_DIR)]) ``` ### Technical Analysis The Skill retrieves the current default branch of an external Git repository without pinning an immutable commit, verifying a signed release, or validating a checksum. Two implementations also update previously retrieved content using `git pull`, allowing the effective local payload to change after the Skill itself has been reviewed. The installation path in `scripts/main.py` invokes: ```bash pip install -e . ``` against an `agent-harness` directory located inside the downloaded repository. Python package installation may execute attacker-controlled build backend, packaging, or setup logic. Consequently, compromi ...[truncated 1794 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the remote repository to a reviewed immutable commit rather than using the current default branch. 2. Verify signed commits or signed release tags before making downloaded content available for installation. 3. Publish and validate cryptographic checksums for approved revisions. 4. Remove automatic `git pull` behavior. Require explicit upgrades that identify and review the exact revision change. 5. Maintain an allowlist of approved harnesses and their expected commit identifiers. 6. Inspect package metadata, build backends, `setup.py`, and related configuration before invoking pip. 7. Install packages in an isolated virtual environment or sandbox with minimal filesystem and credential access. 8. Use dependency lock files and hash verification for transitive Python dependencies. 9. Display the exact repository URL and commit hash and require confirmation before installation. 10. Separate download and installation into distinct operations so retrieved code can be reviewed before any build logic executes. ]]>