T03 · Remote Payload Retrieval and Execution
Warning
- Location
SKILL.md:43- Finding
Execution of Unpinned Code from a Mutable Remote Git Repository
- Content
View full analysis
# Initialize in current directory uvx --from git+https://github.com/github/spec-kit.git specify init . uvx --from git+https://github.com/github/spec-kit.git specify init --here ``` A related example permits execution from a mutable, user-selected branch: ```bash # Push branch first git push origin your-feature-branch # Test via uvx uvx --from git+https://github.com/github/spec-kit.git@your-feature-branch \ specify init demo-branch-test --script ps ``` ### Technical Analysis The documented installation workflow instructs users to invoke `uvx` with a Git repository URL. `uvx` retrieves the Python project from the remote repository, resolves or builds it, and executes its `specify` entry point with the invoking user's privileges. The main commands do not pin the source to an immutable, reviewed commit hash or cryptographically verified release. Consequently, the effective code executed by users can change after this Skill has been audited. The branch-testing example is more exposed because it explicitly executes code from a mutable branch selected by the user. This creates a remote payload substitution risk. If the upstream repository, its default branch, a referenced feature branch, or a maintainer account is compromised, an attacker can alter the package executed by otherwise unchanged instructions. Although the URL points to the declared official GitHub organization and no present upstream compromise is established, the instructions lack controls that bind execution to reviewed content. ### Attack Path 1. An attacker compromises an upstream maintainer account, repository workflow, default b ...[truncated 1363 chars]- Remediation
View remediation
\ specify init ``` 2. Prefer a trusted, versioned package release with locked transitive dependencies and hash verification where the package-distribution mechanism supports it. 3. Record the expected release version, commit hash, and verification procedure directly in `SKILL.md` so users can confirm the retrieved source matches the reviewed artifact. 4. Remove the arbitrary feature-branch execution example from general user instructions. If branch testing is required for contributors, clearly state that it executes unreviewed code and restrict it to branches controlled and reviewed by the user. 5. Perform remote tooling execution in an isolated environment with minimal filesystem access, no unnecessary credentials, and no elevated privileges. 6. Periodically review and deliberately update the pinned revision rather than silently tracking mutable upstream content. ]]>