T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:413
- Finding
- Mutable Third-Party Repository Is Downloaded and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 413–415 **Vulnerability Type**: Remote payload retrieval and insecure software supply chain **Risk Level**: High ### Vulnerable Code ```bash git clone https://github.com/PayRam/payram-helper-mcp-server cd payram-helper-mcp-server yarn install && yarn dev ``` ### Technical Analysis The integration instructions clone the current state of a remote Git repository and immediately install and execute its contents. The repository is not pinned to a reviewed commit, release tag, or cryptographically verified artifact. Both execution stages introduce risk: - `yarn install` can execute package lifecycle scripts supplied by direct or transitive dependencies. - `yarn dev` executes the downloaded project's development command. - The effective code can change after this skill has been reviewed because the cloned branch is mutable. - No commit signature, checksum, lockfile integrity check, or sandboxing requirement is specified. The downloaded repository and its dependency graph are outside the audited artifact, so their behavior cannot be validated by this audit. This is primarily remote payload retrieval and execution, with an additional insecure-dependency aspect. ### Attack Path 1. An attacker compromises the referenced GitHub repository, its maintainer account, the default branch, or one of its package dependencies. 2. The attacker inserts malicious code into the repository, a package lifecycle script, or a transitive dependency. 3. A user follows the documented integration instructions and clones the mutable repository. 4. `yarn install` executes malicious lifecycle code, or `yarn dev` launches the malicious application payload. 5. The payload runs with the permissions and environment of the invoking user. This path is conditional on an upstream compromise or malicious upstream update and on a user executing the documented commands. ### Impact Assessment Successful exploitation could pr ...[truncated 645 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the repository to a specific reviewed commit rather than cloning and executing the mutable default branch: ```bash git clone https://github.com/PayRam/payram-helper-mcp-server cd payram-helper-mcp-server git checkout --detach <reviewed-commit-sha> ``` 2. Publish the expected commit hash and verify a signed commit or signed release before installation. 3. Require the committed dependency lockfile and use the package manager's immutable installation mode, such as: ```bash yarn install --immutable ``` Use `--frozen-lockfile` instead if required by the applicable Yarn version. 4. Review direct and transitive dependencies and scan them for known vulnerabilities before execution. 5. Disable dependency lifecycle scripts during installation where feasible, then explicitly review any scripts that must run. 6. Run the external project in an isolated, least-privileged container or virtual machine with: - No unnecessary host filesystem mounts - No privileged mode - No sensitive environment variables - Restricted outbound network access - A non-root user - Read-only filesystems where practical 7. Separate installation from execution so users can inspect the retrieved source and package scripts before starting the service. 8. Document the exact reviewed release, its checksum, supported dependency versions, and a reproducible verification procedure. ]]>