T03 · Remote Payload Retrieval and Execution
- Location
SKILL.md:69- Finding
External Application Binary Is Installed and Executed Without Integrity Verification
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:69-76; related mutable download declarations appear atSKILL.md:15-19andclawhub.json:43-48
Vulnerability Type: Unverified remote payload retrieval and execution
Risk Level: HighVulnerable code:
markdown Download the latest version from GitHub Releases:https://github.com/yi-nology/sidecarOneStep/releases/latest
text Or direct download: ```bash curl -L -o SidecarOneStep.dmg https://github.com/yi-nology/sidecarOneStep/releases/download/v1.3.9/SidecarOneStep_Installer.dmg hdiutil attach SidecarOneStep.dmg cp -R /Volumes/SidecarOneStep\ Installer/SidecarOneStep.app /Applications/text The associated installation metadata contains a mutable release URL: ```json { "type": "download", "url": "https://github.com/yi-nology/sidecarOneStep/releases/latest", "message": "Please download and install SidecarOneStep from GitHub Releases" }After installation, the downloaded executable is registered as an MCP server:
json { "type": "command", "cmd": "mcporter config add sidecar-onestep --command /Applications/SidecarOneStep.app/Contents/MacOS/SidecarOneStep --args mcp", "message": "Configure SidecarOneStep MCP server" }Technical Analysis
The skill directs users or an installation system to retrieve an opaque DMG from an external release channel, copy the contained application into
/Applications, and register its executable withmcporter. No SHA-256 digest, cryptographic release signature, Apple Team ID, code-signing requirement, or notarization check is provided before the application is trusted and executed.The
/releases/latestendpoint is mutable, so the artifact selected after the audit can differ from the artifact available during review. Even the version-specific download is trusted solely through its remote URL and is not independently pinned by content digest. The repository do ...[truncated 2152 chars]- Remediation
View remediation
Remediation Suggestions
- Replace every mutable
/releases/latestreference with one explicitly approved version. - Publish a trusted SHA-256 digest for each architecture-specific DMG and verify it before mounting:
bash echo "EXPECTED_SHA256 SidecarOneStep.dmg" | shasum -a 256 -c - - Abort installation if digest verification fails; never continue with only a warning.
- Verify the installed application's Apple signature and expected Team ID:
bash codesign --verify --deep --strict --verbose=2 /Applications/SidecarOneStep.app codesign -dv --verbose=4 /Applications/SidecarOneStep.app - Validate notarization and Gatekeeper acceptance:
bash spctl --assess --type execute --verbose=4 /Applications/SidecarOneStep.app - Store expected hashes and signing identities in reviewed, version-controlled metadata rather than retrieving them from the same release location as the binary.
- Make
package.json,clawhub.json, documentation, and publishing scripts use one consistent version. - Prefer a reproducible build or include reviewable application source and signed provenance attestations so the distributed binary can be tied to audited source.
- Register the executable with
mcporteronly after all integrity, signing-identity, and notarization checks succeed.
- Replace every mutable