T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/validate-skills-repo.sh:23- Finding
Unpinned Remote Payload Retrieval and Execution Through uvx
- Content
View full analysis
&1 | grep -q "Valid skill"; then echo "✓ $skill_name" ``` The same unpinned command is also recommended in the project documentation: ```bash uvx --from git+https://github.com/agentskills/agentskills#subdirectory=skills-ref skills-ref validate ./skill ``` ### Technical Analysis The script instructs `uvx` to retrieve and execute the `skills-ref` package directly from a Git repository without specifying an immutable commit hash or signed release. Consequently, the code executed by this command can change after the Skill has been reviewed. Although the URL points to the declared upstream Agent Skills repository and no malicious upstream content was identified during this audit, the absence of an immutable revision creates a remote-payload and supply-chain trust boundary. A compromise of the repository, its maintainers, the referenced branch, or the dependency build process could cause arbitrary replacement code to execute the next time validation runs. The invocation is particularly sensitive in automated CI environments, where the process may have access to repository write tokens, release credentials, signing material, cloud environment variables, or other workflow secrets. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or another mechanism capable of changing the Git revision resolved by the unpinned URL. 2. The attacker modi ...[truncated 1240 chars]- Remediation
View remediation
" uvx --from \ "git+https://github.com/agentskills/agentskills@${SKILLS_REF_COMMIT}#subdirectory=skills-ref" \ skills-ref validate "$skill_dir" ``` 2. Prefer a signed, versioned release with locked transitive dependencies when the upstream project provides one. 3. Record and verify package hashes where the installation mechanism supports hash verification. 4. Update the pinned revision only through a reviewed dependency-update process. 5. Run validation in an isolated environment with: - No production deployment credentials. - Read-only repository access where possible. - Minimal filesystem permissions. - Restricted outbound network access. - Short-lived, least-privilege CI tokens. 6. Update every documented command in `SKILL.md` and `references/validation.md` so users are not encouraged to bypass the pinned invocation. ]]>