T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:41
- Finding
- Mutable Remote Package Is Downloaded and Executed Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:41-47` **Additional References**: `SKILL.md:53-64`, `SKILL.md:78-90`, `SKILL.md:189-243`, `SKILL.md:276` **Vulnerability Type**: Remote execution of an unpinned third-party package **Risk Level**: High ### Vulnerable Code ```markdown 2. **Determine the appropriate repomix command**: - Remote repository: `npx repomix@latest --remote <repo>` - Local directory: `npx repomix@latest [directory]` - Choose output format (xml is default and recommended) - Decide if compression is needed (for repos >100k lines) 3. **Execute the repomix command** via shell ``` The same unsafe pattern is prescribed by the primary workflow: ```bash npx repomix@latest --remote <repo> --output /tmp/<repo-name>-analysis.xml ``` ```bash npx repomix@latest [directory] [options] ``` ### Technical Analysis The Skill repeatedly instructs the agent to invoke `npx repomix@latest`. If the package is not already available locally, `npx` can retrieve it from the configured npm registry and immediately execute its entry point. The `latest` tag is mutable and does not identify a reviewed, immutable package version. Consequently, the code executed at invocation time can differ from the code that existed when this Skill was audited. There is no exact version pin, lockfile, package integrity requirement, or independent verification step in the project. This creates a remote payload retrieval and execution channel through the npm supply chain. The issue does not prove that Repomix itself is malicious. The vulnerability is that the documented execution mechanism implicitly trusts future content associated with a mutable remote package tag. ### Attack Path 1. An attacker compromises the package publisher account, npm package, registry resolution path, or a future release associated with the `latest` tag. 2. A user asks the agent to analyze a repository using this Skill. 3. The agent follows the instructions and runs `npx re ...[truncated 1073 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `repomix@latest` with an explicitly reviewed version, such as `repomix@x.y.z`. 2. Manage the package through a committed lockfile that records resolved package versions and integrity hashes. 3. Install dependencies in a controlled build step rather than allowing `npx` to download packages during each Skill invocation. 4. Use `npx --offline` or `npx --no-install` after installing and verifying the approved dependency. 5. Verify package provenance and integrity through trusted registry metadata, signatures, or an approved internal artifact repository. 6. Run repository analysis in a sandbox with minimal filesystem access, restricted environment variables, and limited network connectivity. 7. Require explicit user confirmation before any package download or first-time third-party code execution. 8. Establish a dependency update process in which new versions are reviewed and tested before the pinned version is changed. ]]>