T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:14- Finding
Execution of an Unpinned Mutable Remote Repository
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:14-17
Vulnerability Type: Remote supply-chain code execution
Risk Level: HighVulnerable Code
bash **IMPORTANT: Always use the custom fork with attachment support:** ```bash uvx --from "git+https://github.com/shanemcd/gcalcli@attachments-in-tsv-and-json" --with "google-api-core<2.28.0" gcalclitext Equivalent mutable-repository commands are repeated throughout `SKILL.md`. ### Technical Analysis The skill directs users and agents to retrieve and execute Python code directly from the mutable `attachments-in-tsv-and-json` branch of a personal GitHub fork. The reference is not pinned to a reviewed commit hash, signed release, immutable artifact, or verified checksum. Consequently, the effective code executed by `uvx` can change after the skill has been reviewed. A repository owner, compromised maintainer account, malicious collaborator, or attacker who compromises the repository can replace the branch contents. The modified package would then execute locally whenever one of the documented commands is invoked. The dependency also operates in a sensitive context: it initiates Google OAuth authentication, accesses calendar information, and may receive event descriptions, attendee information, conference links, and attachment URLs. Although the version constraint on `google-api-core` limits its version, it does not provide integrity protection for the primary Git dependency. ### Attack Path 1. An attacker compromises the custom fork, its maintainer account, or the referenced branch. 2. The attacker modifies the branch to include malicious Python code in package initialization or command execution paths. 3. A user or agent follows the skill and runs the documented `uvx --from git+https://...` command. 4. `uvx` retrieves the current branch contents and executes them with the invoking user's privileges. 5. The malicious code can access data and res ...[truncated 1060 chars]- Remediation
View remediation
Remediation Suggestions
- Prefer an audited official
gcalclirelease that contains the required functionality. - If the fork is unavoidable, pin it to a specific reviewed commit hash rather than a mutable branch:
bash uvx --from "git+https://github.com/shanemcd/gcalcli@<reviewed-commit-hash>" \ --with "google-api-core<2.28.0" gcalcli - Record the approved commit and review its complete dependency tree before deployment.
- Build an immutable wheel from the reviewed source and publish it through a controlled internal package registry.
- Verify artifact hashes or signatures during installation.
- Apply the same immutable reference to every command example in
SKILL.md; do not leave fallback examples that use the mutable branch. - Run the dependency in a sandbox or container with narrowly scoped filesystem and network access.
- Request only the minimum Google OAuth scopes required for read-only calendar operations.
- Establish a controlled update process in which new commits are reviewed and explicitly approved before the pinned reference is changed.
- Prefer an audited official