T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.en.md:42
- Finding
- Execution of Unpinned Code from a Mutable Remote Repository## Vulnerability Details **File Location**: `SKILL.en.md:42-61`; equivalent instructions in `SKILL.md:35-53` **Vulnerability Type**: Remote payload retrieval and execution from an unpinned source **Risk Level**: High **Complete Code Snippet (`SKILL.en.md`)**: ```bash # The Benxiang protocol repo git clone https://github.com/dongsheng123132/2origin.git cd 2origin # Verify npm run test:e2e # 25 assertions (spawns a real subprocess over stdio JSON-RPC) ``` ```bash # Create a package (empty — every decision must enter via a transaction, so it carries provenance) node adapters/memory/init.mjs ./my-project.origin my-project "My Project" # Wire it into Claude Code claude mcp add benxiang -- node /absolute/path/adapters/memory/mcp-server.mjs /absolute/path/my-project.origin # Or via environment variable ORIGIN_PKG=<package-path> node adapters/memory/mcp-server.mjs ``` **Equivalent Code Snippet (`SKILL.md`)**: ```bash # 本象协议仓库 git clone https://github.com/dongsheng123132/2origin.git cd 2origin # 验证 npm run test:e2e # 25 项断言（真起子进程走 stdio JSON-RPC） ``` ```bash # 建包（空的——每条决策都必须经由事务写入，才都自带来历） node adapters/memory/init.mjs ./my-project.origin my-project "我的项目" # 接进 Claude Code claude mcp add benxiang -- node /绝对路径/adapters/memory/mcp-server.mjs /绝对路径/my-project.origin # 或设环境变量 ORIGIN_PKG=<包路径> node adapters/memory/mcp-server.mjs ``` ### Technical Analysis The installation procedure clones the current state of a third-party GitHub repository without selecting an immutable commit hash, signed tag, or verified release artifact. It then directs the user to execute npm lifecycle commands and Node.js files obtained from that repository. Consequently, the effective executable payload is not fixed at the time this Skill is reviewed. The repository owner, an attacker who compromises the repository or maintainer account, or another party able to alter the fetched branch ...[truncated 2447 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the mutable clone instruction with checkout of a reviewed, immutable commit hash or a cryptographically signed release tag. 2. Publish the expected commit identifier and cryptographic checksums for all executed artifacts, and require verification before any npm or Node.js command runs. 3. Vendor the minimal MCP server implementation into the audited package where practical so the executed code is included in the security review. 4. If dependencies are required, include a lockfile and use `npm ci` rather than an unconstrained installation workflow. Pin dependency versions and verify package integrity metadata. 5. Avoid treating `npm run test:e2e` as a security verification step unless the test code and every invoked lifecycle script have first been reviewed; tests are executable code. 6. Run the server in a sandbox or container with a dedicated low-privilege account, a restricted filesystem view, no unnecessary credentials, and outbound network access disabled unless explicitly required. 7. Limit the MCP server to the specific `.origin` package directory and document all files, environment variables, and network resources it needs. 8. Require explicit review and reapproval before updating the pinned revision. Do not automatically track the repository's default branch. 9. Apply the same hardened installation instructions consistently to both `SKILL.en.md` and `SKILL.md`.