T03 · Remote Payload Retrieval and Execution
- Location
SKILL.md:64- Finding
Unpinned Remote SDK Retrieval and Execution
- Content
View full analysis
Vulnerability Details
File Locations:
SKILL.md:64-69README.md:40-43quickstart.md:41-44TEST_GUIDE_FOR_AGENT.md:31-34
Vulnerability Type: Mutable remote payload retrieval followed by local dependency and script execution
Risk Level: MediumVulnerable Code
bash git clone https://github.com/Ghoscro/mickerbook-agent-sdk.git # Enter the directory and run local QA cd mickerbook-agent-sdk npm install npm run qaEquivalent unpinned clone-and-execute instructions appear in all four listed documentation files.
Technical Analysis
The Skill instructs users to clone the default branch of an external GitHub repository without selecting an immutable commit or verified release tag. It then instructs them to run
npm installandnpm run qa.This means the code ultimately executed is not restricted to the content reviewed as part of this Skill package. The repository's default branch can change after publication of Skill version 1.4.5. In addition,
npm installmay execute package lifecycle scripts and resolve third-party dependencies whose integrity and lock state cannot be verified from this documentation-only artifact.npm run qaexecutes commands defined by the downloaded repository.The repository is consistently identified as the official MickerBook SDK, and no malicious payload was found in the audited package itself. Nevertheless, this creates a mutable remote code-execution channel and supply-chain trust boundary.
Attack Path
- An attacker compromises the referenced SDK repository, gains permission to modify its default branch, or compromises a dependency resolved during installation.
- The attacker adds malicious logic to a package lifecycle script, QA script, dependency, or executable imported by those scripts.
- A user follows the Skill instructions and clones the repository without pinning an audited commit.
- The user runs
npm install, which ma ...[truncated 1148 chars]
- Remediation
View remediation
Remediation Suggestions
-
Pin the SDK checkout to an immutable, audited commit hash or signed release tag instead of cloning and executing the default branch.
-
Publish a versioned release archive and document a cryptographic checksum that users must verify before execution.
-
Include and maintain a dependency lockfile, then use
npm ciinstead ofnpm installto prevent uncontrolled dependency resolution. -
Perform the initial installation with lifecycle scripts disabled where compatible:
bash npm ci --ignore-scripts -
Require users to inspect
package.json, lifecycle hooks, and theqascript before executing repository-defined commands. -
Run SDK tests in an isolated container or restricted development account without production API keys, cloud credentials, SSH agents, or access to sensitive local files.
-
Apply the same pinned and verified instructions consistently in
SKILL.md,README.md,quickstart.md, andTEST_GUIDE_FOR_AGENT.md.
-