T03 · Remote Payload Retrieval and Execution
Warning
- Location
- SKILL.md:30
- Finding
- Execution of a Mutable, Unpinned npm Package Without Installation Confirmation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 30-41; related automatic installation guidance at line 86 **Vulnerability Type**: Mutable remote dependency retrieval and execution **Risk Level**: Medium ### Vulnerable Code ```markdown Prefer the direct CLI when the agent can run shell commands. It does not require MCP server configuration: ```bash npx -y socialdatax-skills@latest douyin comments \ --aweme-id "<aweme_id>" --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill socialdatax-douyin-comments npx -y socialdatax-skills@latest douyin comments \ --url "<douyin_content_url_or_share_text>" --pretty \ --source-client socialdatax-skills --source-platform clawhub \ --source-skill socialdatax-douyin-comments npx -y socialdatax-skills@latest douyin replies \ --aweme-id "<aweme_id>" --comment-id "<comment_id>" --pretty \ --source-client socialdatax-skills --source-platform clawhub \ --source-skill socialdatax-douyin-comments ``` ``` Related automatic installation instruction: ```markdown If the current environment has permission, install or restore automatically. ``` The package is also declared without an exact version in the metadata: ```yaml "install":[{"kind":"node","package":"socialdatax-skills","bins":[]}] ``` ### Technical Analysis The Skill directs the agent to execute `socialdatax-skills@latest` through `npx -y`. The `@latest` tag is mutable and can resolve to a different package version after this Skill has been reviewed. The `-y` option automatically accepts npm installation prompts, reducing the opportunity for the user or operator to inspect and approve the resolved version. An npm package executed by `npx` can run package installation lifecycle scripts and its command-line entry point with the privileges of the agent process. In this case, the process is expected to receive `SOCIALDATAX_API_KEY` through the environment and is allowed to make network requests. Dependi ...[truncated 2558 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `socialdatax-skills@latest` with an exact, reviewed version, for example: ```bash npx socialdatax-skills@<exact-reviewed-version> douyin comments ... ``` 2. Enforce package integrity using a lockfile and npm integrity hashes. Prefer a controlled installation step such as `npm ci` against a committed lockfile rather than resolving dependencies dynamically during Skill execution. 3. Remove `-y`, or require explicit user or administrator approval before the initial installation and before every package version change. 4. Remove the instruction to install or restore dependencies automatically. Dependency installation should be a distinct, auditable operation rather than an implicit response to runtime failure. 5. Prefer an already configured and trusted MCP integration when available. Alternatively, vendor and review the minimal client implementation required for the documented read-only operations. 6. Execute the client in a restricted environment: - Provide only `SOCIALDATAX_API_KEY`, rather than inheriting the complete parent environment. - Restrict filesystem access to required locations. - Deny access to browser profiles, SSH material, cloud credentials, and unrelated project files. - Restrict outbound traffic to the documented API endpoint. - Use a non-privileged operating-system account or an isolated container. 7. Document the exact API hosts to which credentials and request data are sent, and validate TLS certificates normally. Never place the API key in command-line arguments, logs, or generated output. 8. Review the pinned package, its transitive dependencies, lifecycle scripts, and published provenance before deployment. Repeat that review before approving an upgrade. ]]>