T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/outsideclaw_setup.sh:14- Finding
Unpinned Remote Repository and Dependency Code Execution
- Content
View full analysis
/dev/null 2>&1; then echo "[outsideclaw] Installing npm deps" npm install --silent else echo "[outsideclaw] ERROR: npm not found. Install Node.js first." exit 2 fi echo "[outsideclaw] Running setup (db/routes dirs)" npm run -s setup ``` The one-click wrapper invokes the installer directly: ```bash # step1: install outsideclaw bash "$SCRIPT_DIR/outsideclaw_setup.sh" ``` ### Technical Analysis The installer clones or updates the mutable default branch of a remote Git repository without pinning an audited commit, validating a signature, or checking a cryptographic digest. It subsequently runs `npm install`, which may execute package lifecycle scripts, and then executes the repository-controlled `setup` npm script. The `OUTSIDECLAW_REPO_URL` environment variable also permits the remote source to be replaced without modifying this Skill. Consequently, the effective executable payload is not limited to the code reviewed in this package and may change after publication. ### Attack Path 1. An attacker compromises the upstream repository, one of its npm dependencies, or the account publishing a dependency. 2. ...[truncated 840 chars]- Remediation
View remediation