devcontainer-setup: two unpinned curl | bash installs in the generated Dockerfile #330

New issue

Open

opened 2026-09-24 05:59:24 +00:00 by clancycodesbad · 0 comments

clancycodesbad commented

2026-09-24 05:59:24 +00:00

(Migrated from github.com)

The Dockerfile template in plugins/devcontainer-setup/skills/devcontainer-setup/resources/Dockerfile pins version and verifies integrity for most fetched tools (git-delta via GIT_DELTA_VERSION, fzf via FZF_VERSION, zsh-in-docker via ZSH_IN_DOCKER_VERSION — each pulling a specific tagged release), but two installs are unpinned curl | bash with no version pin and no checksum verification:

# line 76 — Claude Code
RUN curl -fsSL https://claude.ai/install.sh | bash && \
  claude plugin marketplace add anthropics/skills && \
  ...

# line 90 — fnm (Fast Node Manager)
RUN curl -fsSL https://fnm.vercel.app/install | bash -s -- --install-dir "$FNM_DIR" --skip-shell && \
  ...

Every devcontainer generated from this template executes whatever the two remote scripts contain at build time, with no way to pin to a known-good version or verify the script hasn't changed since review. This is inconsistent with the rest of the file, which otherwise treats supply-chain pinning as the norm.

Suggested fix: pin both to a specific version/commit and verify a checksum before executing, following the pattern already used for zsh-in-docker — e.g. download to a file, verify a published SHA256 (if the upstream project publishes one), then run.

Separately, resources/.zshrc ships an alias:

alias claude-yolo='claude --dangerously-skip-permissions'

This isn't mentioned anywhere in SKILL.md or README.md. Not a security issue on its own (it's visible in the generated .zshrc, not hidden), but worth either documenting why it's there or dropping it, since it's easy to read as an implicitly endorsed workflow rather than a convenience shortcut.

Found during an automated third-party-skill security review before adopting this plugin locally.

The Dockerfile template in `plugins/devcontainer-setup/skills/devcontainer-setup/resources/Dockerfile` pins version and verifies integrity for most fetched tools (`git-delta` via `GIT_DELTA_VERSION`, `fzf` via `FZF_VERSION`, `zsh-in-docker` via `ZSH_IN_DOCKER_VERSION` — each pulling a specific tagged release), but two installs are unpinned `curl | bash` with no version pin and no checksum verification: ```dockerfile # line 76 — Claude Code RUN curl -fsSL https://claude.ai/install.sh | bash && \ claude plugin marketplace add anthropics/skills && \ ... # line 90 — fnm (Fast Node Manager) RUN curl -fsSL https://fnm.vercel.app/install | bash -s -- --install-dir "$FNM_DIR" --skip-shell && \ ... ``` Every devcontainer generated from this template executes whatever the two remote scripts contain at build time, with no way to pin to a known-good version or verify the script hasn't changed since review. This is inconsistent with the rest of the file, which otherwise treats supply-chain pinning as the norm. **Suggested fix:** pin both to a specific version/commit and verify a checksum before executing, following the pattern already used for `zsh-in-docker` — e.g. download to a file, verify a published SHA256 (if the upstream project publishes one), then run. Separately, `resources/.zshrc` ships an alias: ```sh alias claude-yolo='claude --dangerously-skip-permissions' ``` This isn't mentioned anywhere in `SKILL.md` or `README.md`. Not a security issue on its own (it's visible in the generated `.zshrc`, not hidden), but worth either documenting why it's there or dropping it, since it's easy to read as an implicitly endorsed workflow rather than a convenience shortcut. Found during an automated third-party-skill security review before adopting this plugin locally.

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

skills/trailofbits-skills#330

No description provided.

Rows
Columns