T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:9
- Finding
- Unpinned Remote Repository Retrieval and Dependency Execution## Vulnerability Details **File Location**: `SKILL.md:9-14` and `SKILL.md:34-45` **Vulnerability Type**: Unpinned remote payload retrieval and unsafe supply-chain execution **Risk Level**: High ### Vulnerable Code `SKILL.md:9-14`: ```yaml install: - id: clone kind: clone repo: hasd52636-a11y/Auto_Building_new label: Clone AUTO-BUILDING source code ``` `SKILL.md:34-45`: ```bash git clone https://github.com/hasd52636-a11y/Auto_Building_new cd Auto_Building_new ``` ```bash npm install ``` ```bash npm run dev ``` The same installation workflow is repeated in `README.md:20-25`. ### Technical Analysis The Skill retrieves a mutable GitHub repository without pinning it to a reviewed commit hash or cryptographically verified release. It then instructs the user or agent to run `npm install` and `npm run dev` inside the retrieved repository. The executable source, package manifest, lockfile, and transitive dependencies of that external repository are not included in this Skill package and were therefore outside the audited boundary. Consequently, the code that eventually runs can change after this Skill has been reviewed. In addition, `npm install` may execute lifecycle scripts such as `preinstall`, `install`, and `postinstall`. These scripts execute with the privileges of the invoking user. Running `npm run dev` subsequently executes application-defined commands from the remotely retrieved package. This behavior creates both a remote-payload and dependency supply-chain boundary. It exceeds the minimum privileges required for a documentation or configuration Skill because it causes unreviewed external code to be downloaded and executed locally. ### Attack Path 1. An attacker compromises the referenced GitHub account or repository, gains permission to modify its default branch, or compromises one of its npm dependencies. 2. The attacker adds malicious application code, changes an npm script ...[truncated 1429 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the repository installation to a specific, reviewed full commit SHA rather than the mutable default branch. 2. Prefer packaging the reviewed source directly with the Skill so that the distributed and audited payloads are identical. 3. If remote retrieval is unavoidable, publish signed immutable releases and verify the downloaded artifact using a trusted signature or checksum. 4. Include and review a dependency lockfile, then use `npm ci` rather than `npm install` to enforce the locked dependency graph. 5. Use `npm ci --ignore-scripts` during initial installation where lifecycle scripts are not strictly required. 6. If lifecycle scripts are required, document each required script and review its exact implementation before permitting execution. 7. Run the retrieved application in a restricted container or sandbox with minimal filesystem access, no unnecessary credentials, limited network access, and a non-privileged user. 8. Separate source retrieval, integrity verification, dependency installation, and execution into explicit approval steps. 9. Add automated checks that reject unexpected repository revisions, dependency changes, install scripts, and unsigned release artifacts.