T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:29
- Finding
- Execution of Unpinned Remote npm Packages## Vulnerability Details **File Location**: `SKILL.md`, lines 29 and 62 **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution, T08: Insecure Dependencies` **Risk Level**: High **Complete Code Snippet**: ```text npx -y @peakinc/init@latest --yes --json --no-browser ``` ```text npx -y @peakinc/wizard@latest --yes --json --no-browser ``` ### Technical Analysis The Skill instructs the agent to use `npx` to download and execute two npm packages selected through the mutable `latest` tag. The `-y` option suppresses the normal installation confirmation. Consequently, the code executed during a future Skill invocation may differ from the code available when the Skill was audited. This creates both a remote payload execution risk and an insecure software supply-chain dependency. Compromise of the npm publisher account, package registry, package maintainers, or a future release could cause arbitrary attacker-controlled JavaScript to execute locally. No exact package version, package integrity hash, signature verification, or source review requirement is provided. ### Attack Path 1. An attacker compromises the publisher account, release pipeline, or another component used to publish `@peakinc/init` or `@peakinc/wizard`. 2. The attacker publishes a malicious package version and assigns it to the `latest` distribution tag. 3. A user asks the agent to configure Peak for a repository. 4. Following `SKILL.md`, the agent executes the corresponding `npx -y ...@latest` command without an installation prompt. 5. npm retrieves and executes the attacker-controlled package under the agent process's current operating-system account. 6. The malicious package can access resources available to that account, including repository files, process environment variables, local Git configuration, and credentials exposed to the process. ### Impact Assessment Successful exploitation permits arbitrary code execution with the privil ...[truncated 590 chars]
- Remediation
- ## Remediation Suggestions - Replace each `@latest` reference with a reviewed, exact package version, such as `@peakinc/init@X.Y.Z` and `@peakinc/wizard@X.Y.Z`. - Establish a controlled update process in which new versions are reviewed and tested before the pinned version is changed. - Verify downloaded package integrity using a trusted lockfile, registry integrity metadata, signatures, or independently maintained checksums. - Avoid suppressing installation confirmation with `-y` unless execution occurs in a controlled environment and the package version has already been approved. - Require explicit user approval before downloading and executing a package for the first time. - Run the CLI with least privilege in an isolated environment that exposes only the target repository and the minimum required credentials. - Remove unrelated secrets from the child process environment and ensure sensitive credentials are narrowly scoped and short-lived.