T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:30
- Finding
- Execution of Unpinned Code Retrieved from a Mutable Remote Repository## Vulnerability Details **File Location**: `SKILL.md:30-35`; `SKILL.en.md:33-38` **Vulnerability Type**: T03: Remote Payload Retrieval and Execution **Risk Level**: High ### Vulnerable Code `SKILL.md:30-35` ```bash # 本象协议仓库 git clone https://github.com/dongsheng123132/2origin.git cd 2origin # 验证 npm run test:office # 20 项断言（docx + pptx 合成夹具 + 统一 CLI 建包/验证/篡改检出） ``` `SKILL.en.md:33-38` ```bash # The Benxiang protocol repo git clone https://github.com/dongsheng123132/2origin.git cd 2origin # Verify npm run test:office # 20 assertions (docx + pptx synthetic fixtures + unified CLI: build/verify/tamper detection) ``` ### Technical Analysis The installation instructions clone the mutable default branch of an external GitHub repository and subsequently execute an npm script from that repository. No immutable commit, verified release, checksum, or cryptographic signature is specified. Because the effective contents of `test:office` and any scripts it invokes are controlled by the current state of the remote repository, the code executed by users can change after this Skill has been reviewed. The implementation is not included in the audited project, so its behavior and dependency lifecycle cannot be validated from the supplied files. This finding does not establish that the current remote repository is malicious. The vulnerability is the trust model: control of the repository, its default branch, or a relevant dependency can be converted into local code execution when a user follows the documented commands. ### Attack Path 1. An attacker compromises the remote repository owner, a maintainer account, or another mechanism capable of changing the default branch. 2. The attacker modifies the `test:office` npm script, a script it calls, or package lifecycle behavior to execute an arbitrary payload. 3. A user follows the Skill installation instructions and runs: ```bash git clone https://git ...[truncated 1168 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the repository to a specific, reviewed commit rather than relying on its mutable default branch: ```bash git clone https://github.com/dongsheng123132/2origin.git cd 2origin git checkout --detach <reviewed-full-commit-sha> ``` 2. Publish the expected full commit identifier in both Skill files and update it only after security review. 3. Prefer a signed release and verify its signature against a documented, trusted maintainer key before executing any code. 4. If distributing an archive, publish and verify a SHA-256 digest before extraction or execution. 5. Vendor the required implementation into the audited Skill package where feasible, allowing the executed code to be reviewed together with the instructions. 6. Review `package.json`, the exact `test:office` command, npm lifecycle hooks, transitive dependencies, and all scripts reachable from the command before execution. 7. Use lockfiles with integrity metadata and immutable dependency versions. Install dependencies with a reproducible command such as `npm ci`, after reviewing the lockfile. 8. Run verification commands in a disposable, least-privileged container or sandbox without host credentials, sensitive mounts, or unnecessary network access. 9. Keep the Chinese and English instructions synchronized so both versions enforce the same pinned and verified installation process.