T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:193- Finding
Mutable Remote Package Is Downloaded and Executed Through npx
- Content
View full analysis
/tmp/live-spec.json # Store contract snapshot for regression detection npx @claude-flow/cli@latest memory store \ --key "contract-snapshot-$(date +%s)" \ --value "$(cat /tmp/live-spec.json | head -c 5000)" \ --namespace forge-contracts ``` The same mutable `npx @claude-flow/cli@latest` execution pattern is used repeatedly elsewhere in `SKILL.md`, including swarm initialization, memory operations, hooks, and neural training. ### Technical Analysis The skill instructs the agent to execute `@claude-flow/cli` through `npx` using the mutable `latest` distribution tag. If the package is not already available locally, `npx` can download and execute it automatically. The `latest` tag does not identify a fixed, previously audited artifact and can resolve to different package contents after the skill itself has been reviewed. No exact version, package-lock entry, integrity hash, vendored artifact, or trusted installation step constrains the code that will execute. Consequently, compromise of the package, its publishing account, its dependency graph, or the package registry can change the effective executable payload without any modification to this project. This is primarily remote payload retrieval and execution. It also creates a supply-chain risk because the downloaded executable receives the permissions of the user running the agent. ### Attack Path 1. An attacker compromises the `@claude-flow/cli` package, a transitive dependency, or an account authorized to publish it. 2. The attacker publishes a malicious version and assigns it to the `latest` tag. 3. A user invokes Forge in a project environment. 4. Forge follows the inst ...[truncated 1056 chars]- Remediation
View remediation