T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:25- Finding
Execution of Unpinned Code from a Mutable Remote Repository
- Content
View full analysis
- Remediation
View remediation
``` 2. Publish and verify an expected commit identifier or signed release. Prefer cryptographically signed tags or releases and document signature verification. 3. Vendor the reviewed implementation into the skill package when licensing and maintenance requirements permit. This ensures that the audited payload matches the payload users execute. 4. Lock every Python dependency to an exact version and include trusted hashes. Install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 5. Review both direct and transitive dependencies, use a private or explicitly trusted package index where appropriate, and add automated dependency and provenance scanning. 6. Perform installation and execution in an isolated virtual environment or container under a dedicated, unprivileged account. Do not run the installation commands as root or an administrator. 7. Grant the process only the credentials required for enabled features. Keep unrelated secrets out of its environment and rotate credentials if execution of a compromised revision is suspected. ]]>