T03 · Remote Payload Retrieval and Execution
Error
- Location
- README.md:69
- Finding
- Mutable Third-Party Skill Retrieval and Unpinned Dependency Installation## Vulnerability Details **File Location**: `README.md:69-75` **Vulnerability Type**: Mutable remote payload retrieval and insecure dependency installation **Risk Level**: Critical ### Vulnerable Code ```bash # 2. Install sibling skill a-stock-data mkdir -p ~/.claude/skills/a-stock-data curl -o ~/.claude/skills/a-stock-data/SKILL.md \ https://raw.githubusercontent.com/simonlin1212/a-stock-data/main/SKILL.md # 3. Install a-stock-data dependencies pip install mootdx requests pandas stockstats ``` Equivalent unattended installation instructions also appear in `README.md:101-111`. The downloaded Skill is subsequently loaded and its embedded Python is executed by the Agent, as documented in `SKILL.md:33-39`, `SKILL.md:62-69`, and `SKILL.md:90`. ### Technical Analysis The installation procedure downloads `SKILL.md` from the mutable `main` branch of an independently maintained GitHub repository and writes it directly into an active Agent Skill directory. The URL is not bound to an immutable commit, release artifact, checksum, or cryptographic signature. Because the downloaded Skill supplies runtime instructions and embedded Python for the Agent, its effective behavior can change after this repository has been reviewed. A compromise of the upstream repository or account could therefore introduce new Agent instructions or executable code without requiring any change to this project. The installation also invokes `pip install` for four packages without exact versions, hashes, or a lockfile. Dependency resolution consequently depends on mutable package-index state at installation time. This expands the supply-chain trust boundary beyond what is necessary for the bundled K-line, indicator, and batch functionality, which the project itself states uses only the Python standard library. ### Attack Path 1. An attacker compromises the referenced third-party repository, its maintainer account, or a relevant package release process. 2. The attacker modifies the `main` ...[truncated 1176 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the mutable `main` URL with an immutable, reviewed commit URL. 2. Publish and verify a SHA-256 digest or cryptographic signature before activating the downloaded Skill. 3. Download third-party Skill content into a quarantine or staging location and require explicit review before copying it into an active Agent Skill directory. 4. Prefer vendoring the audited third-party functionality into a versioned release when licensing permits. 5. Pin every Python dependency to an exact version in a lockfile. 6. Require package hashes, such as through `pip install --require-hashes -r requirements.lock`. 7. Use an isolated virtual environment with only the permissions required for market-data retrieval. 8. Remove or replace the unattended one-line installer, which combines download, installation, and execution without a review boundary. 9. Document the third-party domains contacted and the minimum filesystem and network permissions required. 10. Re-audit the pinned third-party Skill and dependencies whenever their pinned versions are updated.