T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/bun-workflow.md:9- Finding
Unpinned Bun installer is downloaded and executed directly by a shell
- Content
View full analysis
- Remediation
View remediation
Security audit
TypeScript Package Manager
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly coherent package-manager guidance, but it includes copy-paste workflows that can run unverified remote installers or unpinned downloaded tools.
Install only if you are comfortable treating it as advisory package-manager documentation. Before running any helper or copied command, inspect the exact script, avoid pipe-to-shell installers, prefer pinned OS/package-manager installation methods, and do not use --fix or global install commands until you have reviewed the expected project and lockfile changes.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/bun-workflow.js.txt:191- Finding
Bun helper prints mutable remote-installer commands for users to execute
- Content
View full analysis
- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/pnpm-workflow.md:39- Finding
pnpm installation guide executes unpinned remote scripts directly
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/health-check.md:614- Finding
Health-check workflow can automatically download and execute undeclared packages through npx
- Content
View full analysis
/dev/null || npx --yes type-coverage --version &>/dev/null; then COVERAGE_OUTPUT=$(npx type-coverage --at-least 80 2>&1 || true) ``` ```bash if npx --yes knip --version &>/dev/null 2>&1; then if $FIX; then npx knip --fix 2>&1 || warn "knip --fix completed with warnings" ``` ```bash if npx --yes madge --version &>/dev/null 2>&1; then CIRCULAR=$(npx madge --circular --ts-config tsconfig.json src/ 2>&1 || true) ``` ```bash if npx --yes @arethetypeswrong/cli --version &>/dev/null 2>&1; then echo "Validating declaration files..." if npx attw --pack . 2>&1 | grep -q "No problems found"; then ``` ### Technical Analysis When a requested package is not installed locally, `npx` can retrieve it from the configured npm registry and execute it. The `--yes` option suppresses the interactive installation confirmation. These commands do not pin package versions and are not tied to a reviewed lockfile. As a result, running a nominally diagnostic health check may cause previously absent third-party code to be downloaded and executed. Package runtime code and applicable lifecycle behavior can access the project and the user's environment. The automatic retrieval is unnecessary for a read-only health check; the workflow can instead require reviewed local dev dependencies. The JavaScript helper in `scripts/health-check.js.txt` also invokes `npx`, but it first checks for a tool on `PATH` or under `node_modules/.bin`. The documented shell workflow is more direct because `npx --yes` is expressly used to test for and retrieve absent tools. ### Attack Path 1. A user runs the documented health-check shell workflow in a TypeScript project. 2. One or more health-check utilities are absent locally. 3. `npx --yes` re ...[truncated 1005 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (109)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **Inspect before executing.** The bundled helpers under `scripts/` (notably `bun-workflow.js.txt` and `health-check.js.txt`) shell out to local tools via `chi
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **Inspect before executing.** The bundled helpers under `scripts/` (notably `bun-workflow.js.txt` and `health-check.js.txt`) shell out to local tools via `chi
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ing.** The bundled helpers under `scripts/` (notably `bun-workflow.js.txt` and `health-check.js.txt`) shell out to local tools via `child_process.execSync`. The
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ing.** The bundled helpers under `scripts/` (notably `bun-workflow.js.txt` and `health-check.js.txt`) shell out to local tools via `child_process.execSync`. The
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md ## Safety and Trust Model - **Inspect before executing.** The bundled helpers under `scripts/` (notably `bun-workflow.js.txt` and `health-check.js.txt`) shell out to local tools via `child_process.execSync`. They ship with a `.js.txt` extension so they are not directly executable; open and read each one, rename it back to `.js` only inside a trusted project working directory you control, and run it only after confirming the exact command. - **Verify remote installers.** Any documented one-liner that fetches code from the network (for example `curl -fsSL https://bun.sh/install | bash` or `powershell -c "irm bun.sh/install.ps1 | iex"`) executes whatever the upstream serves at that moment. Confirm the URL, prefer the official downloaded installer or your OS package manager, and pin to a known version when stricter review is required. - **Approve dependency changes explicitly.** Treat installs, updates, removals, audits with `--fix`, and lockfile regenerations as mutating actions. Surface the exact command and the expected `package.json` / lockfile diff first, then proceed only after the user confirms. - **Provenance disclosure.** The helper scripts in this skill are local to this repository and are not currently published with an upstream source or homepage in the registry metadata. Treat them as untrusted code until you have read them, and prefer skills with clear provenance when execution is involved.
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md - **npm-workflow.md** / **npm-workflow.js.txt** - Complete npm workflow from initialization to publishing (rename to `.js` before running with Node) - **yarn-workflow.md** - Complete yarn workflow covering Classic (1.x) and Berry (3.x+) versions - **pnpm-workflow.md** - Complete pnpm workflow with monorepo and workspace features - **bun-workflow.md** / **bun-workflow.js.txt** - Complete bun workflow for ultra-fast package management (rename to `.js` before running). The documented Bun installer one-liners (`curl … | bash`, `irm … | iex`) fetch and execute remote code; verify the source URL and prefer a pinned, downloaded installer when stricter review is required. - **health-check.md** / **health-check.js.txt** - Package manager health check and diagnostics scripts (rename to `.js` before running) ## Assets
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md - **npm-workflow.md** / **npm-workflow.js.txt** - Complete npm workflow from initialization to publishing (rename to `.js` before running with Node) - **yarn-workflow.md** - Complete yarn workflow covering Classic (1.x) and Berry (3.x+) versions - **pnpm-workflow.md** - Complete pnpm workflow with monorepo and workspace features - **bun-workflow.md** / **bun-workflow.js.txt** - Complete bun workflow for ultra-fast package management (rename to `.js` before running). The documented Bun installer one-liners (`curl ... | bash`, `irm ... | iex`) fetch and execute remote code; verify the source URL and prefer a pinned, downloaded installer when stricter review is required. - **health-check.md** / **health-check.js.txt** - Package manager health check and diagnostics scripts (rename to `.js` before running) ## Assets
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. **Regular Audits**: Run security checks regularly 2. **Update Dependencies**: Keep packages up-to-date 3. **Review Lock Files**: Check for unexpected changes 4. **Use .npmrc**: Configure secure defaults 5. **Enable 2FA**: Protect publishing accounts 6. **Verify Packages**: Check package integrity
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. **Regular Audits**: Run security checks regularly 2. **Update Dependencies**: Keep packages up-to-date 3. **Review Lock Files**: Check for unexpected changes 4. **Use .npmrc**: Configure secure defaults 5. **Enable 2FA**: Protect publishing accounts 6. **Verify Packages**: Check package integrity
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. **Regular Audits**: Run security checks regularly 2. **Update Dependencies**: Keep packages up-to-date 3. **Review Lock Files**: Check for unexpected changes 4. **Use .npmrc**: Configure secure defaults 5. **Enable 2FA**: Protect publishing accounts 6. **Verify Packages**: Check package integrity
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. **Regular Audits**: Run security checks regularly 2. **Update Dependencies**: Keep packages up-to-date 3. **Review Lock Files**: Check for unexpected changes 4. **Use .npmrc**: Configure secure defaults 5. **Enable 2FA**: Protect publishing accounts 6. **Verify Packages**: Check package integrity
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. **Regular Audits**: Run security checks regularly 2. **Update Dependencies**: Keep packages up-to-date 3. **Review Lock Files**: Check for unexpected changes 4. **Use .npmrc**: Configure secure defaults 5. **Enable 2FA**: Protect publishing accounts 6. **Verify Packages**: Check package integrity
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. **Regular Audits**: Run security checks regularly 2. **Update Dependencies**: Keep packages up-to-date 3. **Review Lock Files**: Check for unexpected changes 4. **Use .npmrc**: Configure secure defaults 5. **Enable 2FA**: Protect publishing accounts 6. **Verify Packages**: Check package integrity
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. **Regular Audits**: Run security checks regularly 2. **Update Dependencies**: Keep packages up-to-date 3. **Review Lock Files**: Check for unexpected changes 4. **Use .npmrc**: Configure secure defaults 5. **Enable 2FA**: Protect publishing accounts 6. **Verify Packages**: Check package integrity
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. **Regular Audits**: Run security checks regularly 2. **Update Dependencies**: Keep packages up-to-date 3. **Review Lock Files**: Check for unexpected changes 4. **Use .npmrc**: Configure secure defaults 5. **Enable 2FA**: Protect publishing accounts 6. **Verify Packages**: Check package integrity
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. **Regular Audits**: Run security checks regularly 2. **Update Dependencies**: Keep packages up-to-date 3. **Review Lock Files**: Check for unexpected changes 4. **Use .npmrc**: Configure secure defaults 5. **Enable 2FA**: Protect publishing accounts 6. **Verify Packages**: Check package integrity
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text [run] # Default shell for bun run scripts # shell = "system" # Automatically load .env file # bun automatically loads .env, .env.local, .env.development, .env.production [test]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # Default shell for bun run scripts # shell = "system" # Automatically load .env file # bun automatically loads .env, .env.local, .env.development, .env.production [test] # Root directory for test files
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text # Default shell for bun run scripts # shell = "system" # Automatically load .env file # bun automatically loads .env, .env.local, .env.development, .env.production [test] # Root directory for test files
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The migration helper recommends installing Bun via a piped remote script (
curl ... | bash) and PowerShelliex, both of which execute network-fetched code without prior verification. In an agent skill context, surfacing copy-pasteable one-liners that bypass review materially increases supply-chain and remote-code-execution risk if the source, transport, or endpoint is compromised.- Content
text { step: 1, title: 'Install Bun', cmd: 'curl -fsSL https://bun.sh/install | bash # macOS/Linux\n powershell -c "irm bun.sh/install.ps1 | iex" # Windows', }, { step: 2,
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
When Bun is not installed, the script prints a ready-to-run
curl ... | bashand PowerShelliexcommand, encouraging immediate execution of externally fetched code. Even though the script itself does not execute the command, this is dangerous in a helper skill because it normalizes insecure installation practice and can lead to remote code execution if the fetched installer is malicious or tampered with.- Content
text } else { console.log(`\n ${c.yellow('⚠️')} Bun is not installed or not on PATH.`); console.log(`\n Install with:`); console.log(` ${c.cyan('curl -fsSL https://bun.sh/install | bash')} # macOS/Linux`); console.log(` ${c.cyan('powershell -c "irm bun.sh/install.ps1 | iex"')} # Windows`); } console.log();
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
curl -fsSL https://bun.sh/install | bashfetches a remote script and immediately executes it in the shell. This creates a direct arbitrary code execution path if the remote content is malicious or tampered with, and the skill context makes it more dangerous because it is framed as standard setup guidance users are likely to copy-paste blindly.- Content
macOS / Linux
bash curl -fsSL https://bun.sh/install | bashWindows (via PowerShell)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The
| bashchaining is the critical mechanism that converts a remote fetch into immediate code execution without review. This eliminates the user's opportunity to inspect the script and magnifies the impact of any upstream compromise or man-in-the-middle style content tampering.- Content
macOS / Linux
bash curl -fsSL https://bun.sh/install | bashWindows (via PowerShell)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
This repeats the same unsafe remote-script execution pattern in the migration section, reinforcing risky behavior during a common workflow. Because migration instructions are often followed verbatim, the chance of unsafe copy-paste execution is elevated.
- Content
bash # Install Bun curl -fsSL https://bun.sh/install | bash # Remove node_modules and reinstall with Bun rm -rf node_modules
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
This is the same dangerous chaining pattern repeated later in the file. Repetition in setup and migration sections normalizes a risky practice and increases the likelihood of users executing unreviewed remote code.
- Content
bash # Install Bun curl -fsSL https://bun.sh/install | bash # Remove node_modules and reinstall with Bun rm -rf node_modules
Static analysis
No suspicious patterns detected.