T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:43
- Finding
- Unpinned Remote Code Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 43–57 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash # 1. Clone the repo (one-time) git clone https://github.com/zqchris/oura-cli ~/oura-cli cd ~/oura-cli # 2. Register an Oura API app at: # https://cloud.ouraring.com → My Applications → New Application # - Redirect URI: http://localhost:8080/callback # - Scopes: enable all # 3. Authorize (opens browser; one-time per machine) uv run oauth-authorize.py --client-id <ID> --client-secret <SECRET> # 4. Verify uv run oura-data.py today ``` ### Technical Analysis The Skill instructs users or agents to clone the default branch of an external GitHub repository and immediately execute Python programs from it. The dependency is not pinned to a reviewed commit or immutable release, and the instructions provide no checksum, signature verification, or source-review step. Consequently, the code executed at installation time can differ from the code present when this Skill was audited. The external repository is not included in the audited artifact, so claims concerning its token handling, telemetry, and network behavior cannot be independently verified here. This behavior is best classified as remote payload retrieval and execution rather than an ordinary package dependency issue: the effective executable payload is obtained directly from a mutable remote source after Skill review. The OAuth client secret is also supplied as a command-line argument. Depending on the operating system, shell configuration, and process-monitoring permissions, this value could be exposed through shell history, process listings, diagnostic logs, or Agent transcripts. ### Attack Path 1. An attacker compromises the upstream repository, its maintainer account, or the repository's default branch. 2. The attacker modifies `oauth-authorize.py`, `oura-data.py`, or another file executed by `uv`. 3 ...[truncated 1157 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor the required scripts into the Skill so they can be reviewed together with the Skill. 2. If remote retrieval is unavoidable, pin the repository to a specific reviewed commit hash rather than cloning a mutable default branch. 3. Publish and verify a cryptographic checksum or signed release before any downloaded file is executed. 4. Use a repository and release verification process that checks maintainer signatures and provenance. 5. Review downloaded code before execution and run it in a constrained environment with minimal filesystem and network access. 6. Do not pass the OAuth client secret through a command-line argument. Read it through protected interactive input, an appropriately secured credential store, or a permission-restricted configuration file. 7. Document the exact domains the client needs to contact and block unrelated outbound destinations where practical. 8. Re-audit the pinned external code, particularly token storage, refresh behavior, subprocess use, logging, and outbound network requests. ]]>