T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:31
- Finding
- Unpinned Third-Party Components Are Downloaded and Executed in an Authenticated Workday Context## Vulnerability Details **File Location**: `SKILL.md`, lines 31–57 **Vulnerability Type**: Unpinned remote dependencies and mutable code execution **Risk Level**: High ### Vulnerable Code ```json { "mcpServers": { "workday": { "command": "npx", "args": ["-y", "workday-mcp"], "env": { "WORKDAY_TENANT": "your-tenant-slug", "WORKDAY_HOST": "wd5.myworkday.com" } } } } ``` ```bash git clone https://github.com/chrischall/fetchproxy cd fetchproxy npm ci npm --workspace=@fetchproxy/extension-chrome run build ``` ### Technical Analysis The configuration invokes `npx -y workday-mcp` without an exact package version or integrity constraint. When launched, `npx` can retrieve and execute the package version currently resolved by the npm registry. The `-y` option suppresses the normal installation confirmation. The browser-extension setup similarly clones the mutable default branch of a remote Git repository without selecting a reviewed release tag or commit hash. Although `npm ci` provides dependency reproducibility when a valid lockfile is supplied by the repository, it does not establish that the cloned repository revision itself is trusted or unchanged. These components operate in a particularly sensitive context. The MCP server and browser extension bridge a live SSO-authenticated Workday browser session and process HR records, worker profiles, compensation, benefits, and performance information. A malicious or compromised upstream release could therefore execute with the local process privileges of the user and potentially observe data made available through that bridge. No evidence in the audited file demonstrates that the current upstream packages are malicious. The vulnerability is the absence of controls preventing the effective executable payload from changing after the Skill has been reviewed. ### Attack Path 1. An attacker compromises the n ...[truncated 1561 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `workday-mcp` to an exact, reviewed version rather than resolving the latest package: ```json { "command": "npx", "args": ["--no-install", "workday-mcp@X.Y.Z"] } ``` Prefer a separately installed, verified package and a fixed executable path so startup cannot silently download code. 2. Record and verify npm integrity metadata. Use a committed lockfile, verify package provenance where available, and compare the downloaded artifact against an approved checksum before execution. 3. Clone the extension at a reviewed commit hash instead of the mutable default branch: ```bash git clone https://github.com/chrischall/fetchproxy cd fetchproxy git checkout --detach APPROVED_COMMIT_HASH ``` Verify the commit signature or published checksum before building. 4. Vendor or internally mirror approved artifacts where organizational policy permits. Subject updates to code review and dependency scanning before deployment. 5. Document and minimize the browser extension's host permissions. Restrict access to the required Workday hosts and local bridge endpoint rather than broad website access. 6. Run the MCP server with a dedicated, least-privileged local account or sandbox. Deny unnecessary filesystem access and outbound network destinations. 7. Require explicit review before upgrades. Do not automatically replace the package, extension, or transitive dependencies in an environment connected to an authenticated Workday session.