Skip to content

fix(security): Add integrity verification before chmod +x in btrace-perfetto skill #5297

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fix-it-felix-sentry wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(security): Add integrity verification before chmod +x in btrace-perfetto skill #5297

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion .claude/skills/btrace-perfetto/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,18 @@ Before starting, verify:
```
3. **Perfetto trace_processor**: Check if `/tmp/trace_processor` exists. If not, download it:
```bash
curl -sL "https://get.perfetto.dev/trace_processor" -o /tmp/trace_processor && chmod +x /tmp/trace_processor
# Download trace_processor
curl -sL "https://get.perfetto.dev/trace_processor" -o /tmp/trace_processor

# Verify the file is a valid executable (check file type and size)
if [[ ! -s /tmp/trace_processor ]] || ! file /tmp/trace_processor | grep -q "executable"; then
Copy link
Copy Markdown

@cursor cursor bot Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fragile file check may reject valid executables

Medium Severity

The file ... | grep -q "executable" check is unreliable because get.perfetto.dev/trace_processor serves a Python wrapper script, not a native binary. The file command's inclusion of "executable" in its output for scripts depends on the system's file version and magic database — some implementations report shebanged scripts as "Python script, ASCII text" without the word "executable". Additionally, if Perfetto ever changes to serving native PIE ELF binaries, older Linux file versions (< 5.36) report them as "shared object" without "executable". In either case, the validation incorrectly deletes the valid download and exits with an error, breaking the entire workflow.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit c7b4981. Configure here.

echo "Error: Downloaded file is not a valid executable"
rm -f /tmp/trace_processor
exit 1
fi

# Make executable only after verification
chmod +x /tmp/trace_processor
```
4. **Device ABI**: Run `adb shell getprop ro.product.cpu.abi` — btrace only supports arm64-v8a and armeabi-v7a (no x86/x86_64)

Expand Down
Loading