T03 · Remote Payload Retrieval and Execution
Error
- Location
- scripts/weibo-utils.ts:118
- Finding
- Unpinned Runtime Package Is Downloaded and Executed Automatically<![CDATA[ ## Vulnerability Details **File Location**: `scripts/weibo-utils.ts:118-120`; related execution instructions at `SKILL.md:21-26` **Vulnerability Type**: Untrusted remote package retrieval and execution **Risk Level**: High ### Vulnerable Code ```ts function runBunScript(scriptPath: string, args: string[]): boolean { const result = spawnSync('npx', ['-y', 'bun', scriptPath, ...args], { stdio: 'inherit' }); return result.status === 0; } ``` The Skill instructions explicitly authorize the same fallback: ```markdown **Agent Execution Instructions**: 1. Determine this SKILL.md file's directory path as `{baseDir}` 2. Script path = `{baseDir}/scripts/<script-name>.ts` 3. Replace all `{baseDir}` in this document with the actual path 4. Resolve `${BUN_X}` runtime: if `bun` installed → `bun`; if `npx` available → `npx -y bun`; else suggest installing bun ``` ### Technical Analysis The helper invokes `npx -y bun` rather than a locally verified Bun executable. If the package is absent from the local npm cache, `npx` may retrieve it from the configured package registry and execute it automatically. The `-y` option suppresses the interactive installation prompt. No exact package version, package integrity value, trusted registry configuration, or executable checksum is specified at this execution point. Consequently, the effective executable can change after the Skill has been audited. This creates a remote code execution channel dependent on mutable registry content and local npm configuration. Although `bun.lock` pins the project libraries, it does not pin or verify the `bun` package downloaded by this `npx` invocation. ### Attack Path 1. A user invokes the Skill on a system where a trusted local `bun` executable is unavailable. 2. The Skill follows its documented fallback or calls a clipboard helper through `runBunScript`. 3. `npx -y bun` resolves the package using the user's configured npm registry. 4. A compromised registry, compromised package pu ...[truncated 879 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the automatic `npx -y bun` fallback from normal execution. 2. Require a locally installed Bun executable and fail with explicit installation instructions when it is unavailable. 3. Resolve the executable through a trusted absolute path rather than relying solely on `PATH`. 4. If automatic retrieval is unavoidable: - Pin an exact audited version, such as `bun@<exact-version>`. - Restrict downloads to an explicitly trusted registry. - Verify the downloaded artifact against a maintained cryptographic checksum or signature. - Do not use `-y`; require informed user confirmation before downloading executable code. 5. Invoke local helper scripts through the already running Bun process where possible instead of launching `npx` for every clipboard operation. 6. Update `SKILL.md` so its execution instructions do not direct agents to retrieve and run an unpinned package. ]]>