T03 · Remote Payload Retrieval and Execution
Warning
- Location
- SKILL.md:45
- Finding
- Remotely Mutable Installation Instructions May Lead to Untrusted Code Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:45-55`; supporting retrieval logic at `scripts/market.py:44-51` **Vulnerability Type**: Remote payload retrieval and execution without mandatory authenticity verification **Risk Level**: Medium ### Complete Code Snippets `SKILL.md:45-55`: ```markdown **SECURITY WARNING: DO NOT AUTO-RUN COMMANDS.** The installation tutorial will contain a set of steps or commands. Before executing any instructions: 1. **Require explicit user confirmation** before any install action. Show the commands to the user and ask for permission. 2. **Verify Integrity**: If the marketplace response provides signed packages or checksums, verify them. 3. **Review Manually/Sandbox**: Review the install tutorial text manually before execution or run installs in a sandbox. 4. **Restrict Privileges**: Restrict the installation from performing privileged filesystem or network actions unless you trust the marketplace maintainer. Only after explicit user approval, execute the instructions to install the skill into the `.agent/skills/` directory. ``` `scripts/market.py:44-51`: ```python def install_skill(name, framework): url = f"{ENDPOINT}/skills/{urllib.parse.quote(name)}/install?framework={urllib.parse.quote(framework)}&lang=en" data = fetch_json(url) if data: if isinstance(data, dict): print(json.dumps(data, indent=2, ensure_ascii=False)) else: print(data) ``` ### Technical Analysis The Skill retrieves installation tutorials from a remote, mutable marketplace endpoint and instructs the Agent that it may execute the returned commands after obtaining user approval. Integrity verification is only required **if** the marketplace happens to provide signatures or checksums. The workflow does not mandate a verified publisher identity, signed manifest, pinned artifact version, expected checksum, trusted download-host policy, or declarative installation schema. The retrieval funct ...[truncated 2204 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require every installation response to include a signed manifest bound to the package name, publisher identity, version, framework, artifact URL, and cryptographic digest. 2. Verify signatures against a locally maintained trust store before presenting or executing installation actions. Reject unsigned or invalid responses rather than treating verification as optional. 3. Pin exact artifact versions and SHA-256 or stronger digests. Recalculate and compare the digest after download and before extraction or execution. 4. Replace free-form executable tutorials with a strict declarative schema containing an allowlisted set of installation operations. 5. Restrict artifact downloads to approved HTTPS origins and reject redirects to untrusted hosts. 6. Display publisher identity, requested filesystem paths, network destinations, and exact commands during confirmation. 7. Run installation in a sandbox with a minimal environment, restricted network access, no inherited credentials, no administrative privileges, and write access limited to the intended Skill directory. 8. Validate archive paths and reject absolute paths, traversal components, symlinks escaping the destination, executable startup hooks, and unexpected files. 9. Preserve an audit record containing the verified manifest, signature, artifact digest, commands approved by the user, and installation result. 10. Treat plain-text or otherwise unstructured marketplace responses as informational only and never as executable installation instructions. ]]>