T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:27
- Finding
- Mutable External Repository and Unpinned Dependencies Are Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 27–31 and 39 **Vulnerability Type**: Remote payload retrieval and insecure software supply chain **Risk Level**: High ### Vulnerable Code ```bash git clone https://github.com/csacanam/kamino-positions-monitor cd kamino-positions-monitor && npm install ``` ```bash cd "${KAMINO_MONITOR_PATH:-.}" && node kamino_monitor.js wallets.json ``` ### Technical Analysis The installation instructions clone the current default branch of an external Git repository without pinning it to a reviewed commit hash or signed release. The effective code executed by the Skill can therefore change after this artifact has been audited. The subsequent `npm install` also installs dependencies without a visible, audited lockfile in this artifact. Package installation may execute lifecycle scripts such as `preinstall`, `install`, and `postinstall`. Finally, `node kamino_monitor.js wallets.json` directly executes the externally retrieved application. Neither that script nor its dependency tree is present in the audited project, so its behavior and integrity cannot be verified here. Although there is no direct evidence that the current upstream repository or its dependencies are malicious, the documented workflow creates a remote payload execution and supply-chain trust boundary. ### Attack Path 1. An attacker compromises the upstream GitHub repository, its maintainer account, or a dependency selected during `npm install`. 2. The attacker adds a malicious package lifecycle script, modifies `kamino_monitor.js`, or publishes a compromised dependency version. 3. A user follows the documented setup and clones the mutable default branch. 4. `npm install` executes a malicious lifecycle script, or the malicious payload executes when the user invokes `node kamino_monitor.js wallets.json`. 5. The payload runs with the privileges of the user running Node and can access resourc ...[truncated 696 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the external repository to a specific reviewed commit hash or cryptographically signed release rather than cloning a mutable default branch. 2. Vendor the executable source into the Skill package where feasible so that the runtime code can be audited together with the instructions. 3. Include and review a lockfile, then use `npm ci` to install the exact dependency graph. 4. Use `npm ci --ignore-scripts` when package lifecycle scripts are unnecessary. If scripts are required, explicitly audit and allowlist them. 5. Verify release signatures, commit signatures, and artifact checksums before installation or execution. 6. Run the monitor under a dedicated, least-privileged account or sandbox with narrowly restricted filesystem and network access. 7. Provide only the environment variables required for the current operation. Keep Telegram and RPC credentials out of globally inherited environments. 8. Add automated dependency vulnerability, provenance, and integrity checks to the release process.