T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:66
- Finding
- Integrity-Unverified Remote Code Retrieval and Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 66–90 **Vulnerability Type**: Remote payload retrieval and execution without integrity verification **Risk Level**: High ### Vulnerable Code ```bash # Download the release tarball — no git clone needed curl -sL https://github.com/ZhuMorris/agent-causal-decision-tool/archive/refs/tags/v0.10.2.tar.gz -o agent-causal.tar.gz tar -xzf agent-causal.tar.gz pip install agent-causal-decision-tool-0.10.2/ -q ``` Alternative installation instructions: ```bash git clone https://github.com/ZhuMorris/agent-causal-decision-tool.git ~/clawd/agent-causal-decision-tool pip install ~/clawd/agent-causal-decision-tool -q ``` ### Technical Analysis The installation instructions retrieve executable Python package content from a personal GitHub repository and pass it to `pip install` without verifying a cryptographic checksum or trusted signature. Python installation can execute attacker-controlled build backend or setup logic, making the downloaded repository an effective remote code-execution channel. Although the release URL references a tag, the instructions do not verify that the downloaded archive matches a reviewed artifact. The alternative `git clone` workflow is more exposed because it installs the repository's mutable default branch rather than an immutable commit. Compromise of the upstream account, repository, release content, dependencies, or delivery path could therefore alter the code executed after the Skill itself has been reviewed. There is also a version inconsistency: the Skill metadata declares version `0.10.3`, while the release archive instructions install version `0.10.2`. This weakens reproducibility and makes it less clear which implementation was assessed or intended. The network download is relevant to initial setup, but the absence of integrity controls exceeds the minimum privilege and trust necessary to install a statistical analysis tool. The project package contains only do ...[truncated 1780 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor the reviewed implementation inside the Skill package so that the installed code is identical to the audited code. 2. If remote retrieval is necessary, publish a versioned release artifact and pin its expected SHA-256 digest: ```bash curl --fail --show-error --location \ https://github.com/ZhuMorris/agent-causal-decision-tool/archive/refs/tags/v0.10.3.tar.gz \ --output agent-causal.tar.gz echo "<trusted-sha256> agent-causal.tar.gz" | sha256sum --check --strict ``` 3. Abort installation if download or integrity verification fails. Avoid `curl -s` because it suppresses useful diagnostics; use `--fail --show-error`. 4. Sign release artifacts and verify signatures against a documented, independently distributed maintainer key. 5. Remove the mutable default-branch installation path. If Git is required, check out and verify an immutable commit identifier before installation. 6. Pin all transitive Python dependencies and use hash verification, such as a locked requirements file with `pip --require-hashes`. 7. Align the Skill metadata version, release archive version, local source version, and documented schema version. 8. Perform installation in an isolated virtual environment or container using a non-privileged account. Do not run `pip install` with `sudo`. 9. Include the connector implementation in the audited artifact and test that PostHog credentials are neither logged nor transmitted to hosts other than the explicitly configured PostHog instance. ]]>