T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:20- Finding
Unpinned Third-Party Code Retrieval and Installation
- Content
View full analysis
- Remediation
View remediation
``` 2. Verify the checked-out commit or release using a trusted signature or a separately distributed cryptographic checksum before installation. 3. Include a reviewed dependency lockfile and use deterministic installation: ```bash npm ci ``` 4. Audit all direct and transitive dependencies, as well as `preinstall`, `install`, and `postinstall` scripts, before allowing lifecycle execution. 5. Where compatible with the dependency set, initially install without lifecycle scripts: ```bash npm ci --ignore-scripts ``` Run only individually reviewed setup steps afterward. 6. Avoid implicit package retrieval through `npx`. Install a pinned, reviewed Playwright version from the lockfile and invoke its local binary with remote package installation disabled. 7. Prefer vendoring the reviewed CLI source into the skill or publishing a signed, immutable release artifact whose digest is validated during setup. 8. Run dependency installation and CV generation in a restricted container or sandbox with: - No unnecessary host filesystem access. - No access to unrelated credentials. - Restricted outbound network access. - A non-privileged operating-system account. - Resume and API-key access granted only when required. 9. Add automated dependency scanning, lockfile integrity checks, and periodic review of the pinned upstream revision before updating it. ]]>