T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:11
- Finding
- Runtime Execution of an Unpinned Remote CLI Package## Vulnerability Details **File Location**: `SKILL.md:11-18` **Vulnerability Type**: Mutable remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```markdown Use the `npx @openant-ai/cli@latest` CLI to monitor your tasks, check notifications, and get platform statistics. This is your dashboard for staying on top of activity. **Always append `--json`** to every command for structured, parseable output. ## Confirm Authentication ```bash npx @openant-ai/cli@latest status --json ``` ``` The same mutable `@latest` package reference is used throughout the skill for all OpenAnt operations. ### Technical Analysis The skill instructs the agent to execute `@openant-ai/cli` through `npx` using the mutable `latest` distribution tag. `npx` may retrieve and execute package code from an external package registry at invocation time. Consequently, the code that ultimately runs is not fixed to the version that existed when this skill was reviewed. This creates a remote payload retrieval and supply-chain risk. A compromised package publisher account, malicious future release, registry compromise, or unintended breaking release could cause later skill invocations to execute different code without any change to this repository. The `--json` option only controls expected output format and does not constrain package installation or execution behavior. ### Attack Path 1. An attacker compromises the package publisher, registry publication process, or another mechanism controlling the `latest` tag. 2. The attacker publishes a modified version of `@openant-ai/cli` and assigns it to `latest`. 3. The agent invokes any documented command, such as `npx @openant-ai/cli@latest status --json`. 4. `npx` retrieves and executes the attacker-controlled package version. 5. The package code runs with the privileges and environment of the agent process. ### Impact Assessment Successful exploitation could execute arb ...[truncated 441 chars]
- Remediation
- ## Remediation Suggestions - Replace `@latest` with an exact, reviewed package version. - Declare the CLI in a dependency manifest and commit the corresponding lockfile. - Enforce package integrity verification through lockfile integrity hashes or an approved internal package registry. - Install dependencies during a controlled build or deployment stage rather than downloading executable code during each skill invocation. - Review and test new CLI releases before updating the pinned version. - Run the CLI in a restricted environment with minimal filesystem, credential, environment-variable, and network access.