T03 · Remote Payload Retrieval and Execution
Warning
- Location
- SKILL.md:12
- Finding
- Mutable Remote Component Retrieval and Unpinned CLI Execution## Vulnerability Details **File Location**: `SKILL.md:12-16` **Vulnerability Type**: Remote payload retrieval through an unpinned package and mutable component registry **Risk Level**: Medium ```bash Install via shadcn registry: ```bash npx shadcn@latest add https://ai-elements.vercel.app/r/[component-name] ``` ``` The same installation pattern is prescribed again in `SKILL.md:27-30` as a required setup gate. ### Technical Analysis The documented installation command executes the mutable `latest` version of the `shadcn` npm package and instructs it to retrieve component source from an external registry. Neither the CLI package nor the downloaded component artifact is pinned to an immutable version, commit, checksum, or signature. Consequently, the code executed or installed when a user follows these instructions can differ from the code available at audit time. Although the referenced npm package and Vercel domain are consistent with the declared purpose of the Skill and no malicious intent was identified, compromise or unexpected modification of either upstream distribution channel could introduce arbitrary code into the target project. The command also executes under the privileges of the invoking user. Depending on npm configuration and the package behavior, retrieved dependencies or lifecycle operations may run code during installation. ### Attack Path 1. An attacker compromises the npm package distribution channel, the mutable `latest` release, the remote component registry, or another relevant upstream delivery mechanism. 2. The attacker publishes a modified CLI package or component payload containing malicious source or installation behavior. 3. A user or Agent follows the Skill instructions and runs: `npx shadcn@latest add https://ai-elements.vercel.app/r/[component-name]`. 4. `npx` resolves and executes the then-current CLI release, which retrieves the then-current remote component payload. 5. The al ...[truncated 919 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `shadcn@latest` with an exact, reviewed version, such as `shadcn@X.Y.Z`. 2. Pin component artifacts to immutable release versions or commit-addressed registry URLs where supported. 3. Publish and verify cryptographic checksums or signatures for downloaded component artifacts. 4. Run installation in a restricted environment without production credentials or unnecessary filesystem access. 5. Review generated source-code and lockfile diffs before building or executing the installed components. 6. Use a committed lockfile and package-manager integrity verification. 7. Disable or restrict dependency lifecycle scripts where operationally feasible. 8. Document the exact reviewed CLI and component versions in the Skill so future installations reproduce the audited state.