T03 · Remote Payload Retrieval and Execution
Error
- Location
- install.sh:100
- Finding
- Automatic Retrieval and Execution of Mutable Remote Code<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:26-31`; `install.sh:4, 100-124, 193-194` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```markdown 1. **Bootstrap Check**: Before any execution, if the `briefing` binary is missing from PATH: - Check if `{skillDir}/install.sh` exists. - If found, execute `bash {skillDir}/install.sh` to initialize the environment. ``` ```bash REPO_URL="${REPO_URL:-https://github.com/YutaiGu/skill-briefing.git}" ``` ```bash sync_repo() { mkdir -p "$(dirname "$INSTALL_DIR")" if [ -d "$INSTALL_DIR/.git" ]; then log "Updating existing repo in $INSTALL_DIR" git -C "$INSTALL_DIR" pull else if [ -e "$INSTALL_DIR" ] && [ -n "$(ls -A "$INSTALL_DIR" 2>/dev/null || true)" ]; then echo "INSTALL_DIR exists and is not a git repo: $INSTALL_DIR" echo "Use an empty directory or pass INSTALL_DIR=/path/to/dir" exit 1 fi log "Cloning repo to $INSTALL_DIR" git clone "$REPO_URL" "$INSTALL_DIR" fi } setup_python_env() { log "Creating virtual environment" "$PYTHON_BIN" -m venv "$VENV_DIR" log "Installing Python dependencies" "$VENV_DIR/bin/pip" install -U pip setuptools wheel "$VENV_DIR/bin/pip" install -r "$INSTALL_DIR/requirements.txt" } ``` ```bash verify_install() { "$VENV_DIR/bin/python" -c "import sys; sys.path.insert(0, '$INSTALL_DIR'); import main" >/dev/null ``` ### Technical Analysis The skill instructions direct the agent to execute `install.sh` automatically whenever the `briefing` command is unavailable. The installer then clones or updates a mutable Git repository without pinning a commit, tag, or verified content digest. The resulting remote source is trusted immediately. Its dependency manifest is passed to `pip`, and its `main.py` module is explicitly imported. Python imports execute module-level statements, so the verification step is itself a direct execution sink for remotely retr ...[truncated 1629 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bundle the reviewed CLI implementation with the skill instead of downloading executable source during first use. 2. If remote retrieval is unavoidable, pin an immutable Git commit hash and verify the checked-out commit before executing any file. 3. Verify downloaded source using a trusted cryptographic signature or a digest distributed independently of the repository. 4. Remove or strictly validate the `REPO_URL` override in automatic installation paths. 5. Do not run `git pull` against an unconstrained branch. Fetch and check out only the approved immutable revision. 6. Replace the executable import check with a non-executing validation where possible. If execution is required, perform it only after source verification in a restricted sandbox. 7. Require explicit user approval before downloading or executing external code, and clearly display the repository and revision that will be used. ]]>