T03 · Remote Payload Retrieval and Execution
Warning
- Location
- SKILL.md:64
- Finding
- Unpinned Remote SDK Retrieval and Execution## Vulnerability Details **File Locations**: - `SKILL.md:64-69` - `README.md:40-43` - `quickstart.md:41-44` - `TEST_GUIDE_FOR_AGENT.md:31-34` **Vulnerability Type**: Mutable remote payload retrieval followed by local dependency and script execution **Risk Level**: Medium ### Vulnerable Code ```bash git clone https://github.com/Ghoscro/mickerbook-agent-sdk.git # Enter the directory and run local QA cd mickerbook-agent-sdk npm install npm run qa ``` Equivalent unpinned clone-and-execute instructions appear in all four listed documentation files. ### Technical Analysis The Skill instructs users to clone the default branch of an external GitHub repository without selecting an immutable commit or verified release tag. It then instructs them to run `npm install` and `npm run qa`. This means the code ultimately executed is not restricted to the content reviewed as part of this Skill package. The repository's default branch can change after publication of Skill version 1.4.5. In addition, `npm install` may execute package lifecycle scripts and resolve third-party dependencies whose integrity and lock state cannot be verified from this documentation-only artifact. `npm run qa` executes commands defined by the downloaded repository. The repository is consistently identified as the official MickerBook SDK, and no malicious payload was found in the audited package itself. Nevertheless, this creates a mutable remote code-execution channel and supply-chain trust boundary. ### Attack Path 1. An attacker compromises the referenced SDK repository, gains permission to modify its default branch, or compromises a dependency resolved during installation. 2. The attacker adds malicious logic to a package lifecycle script, QA script, dependency, or executable imported by those scripts. 3. A user follows the Skill instructions and clones the repository without pinning an audited commit. 4. The user runs `npm install`, which ma ...[truncated 1148 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the SDK checkout to an immutable, audited commit hash or signed release tag instead of cloning and executing the default branch. 2. Publish a versioned release archive and document a cryptographic checksum that users must verify before execution. 3. Include and maintain a dependency lockfile, then use `npm ci` instead of `npm install` to prevent uncontrolled dependency resolution. 4. Perform the initial installation with lifecycle scripts disabled where compatible: ```bash npm ci --ignore-scripts ``` 5. Require users to inspect `package.json`, lifecycle hooks, and the `qa` script before executing repository-defined commands. 6. Run SDK tests in an isolated container or restricted development account without production API keys, cloud credentials, SSH agents, or access to sensitive local files. 7. Apply the same pinned and verified instructions consistently in `SKILL.md`, `README.md`, `quickstart.md`, and `TEST_GUIDE_FOR_AGENT.md`.