T03 · Remote Payload Retrieval and Execution
Error
- Location
- websearch-call.mjs:56
- Finding
- Unpinned Third-Party Package Is Downloaded and Executed with the Full Process Environment<![CDATA[ ## Vulnerability Details **File Location**: `websearch-call.mjs`, lines 56-63 **Vulnerability Type**: Mutable remote dependency execution and excessive environment inheritance **Risk Level**: High ### Vulnerable Code ```js const child = spawn('npx', ['open-websearch@latest'], { env: { ...process.env, MODE: 'stdio', DEFAULT_SEARCH_ENGINE: 'duckduckgo', ALLOWED_SEARCH_ENGINES: engines.join(','), }, stdio: ['pipe', 'pipe', 'inherit'], }); ``` ### Technical Analysis The fallback search implementation invokes `npx open-websearch@latest`. The mutable `latest` tag permits the effective code executed by the Skill to change after the Skill itself has been reviewed. There is no lockfile, exact version, integrity hash, or locally audited copy constraining which package release is executed. The spawned package also inherits the complete parent environment through `...process.env`. Depending on the runtime configuration, this environment may contain `YNOTE_API_KEY`, `PERPLEXITY_API_KEY`, `BRAVE_API_KEY`, or unrelated credentials available to the Agent process. The downloaded package therefore receives substantially more privilege than is necessary to perform an unauthenticated fallback web search. Although the package is declared as a search dependency, downloading and executing its latest release at runtime creates a remote code execution channel and a supply-chain trust dependency that exceeds minimum privilege. ### Attack Path 1. An attacker compromises the `open-websearch` package, its publishing account, or a package release referenced by the `latest` tag. 2. The attacker publishes a malicious release and causes it to become `latest`. 3. Perplexity and Brave search are unavailable or fail, causing the workflow to use the open-websearch fallback. 4. The Skill runs `npx open-websearch@latest`, which downloads and executes the attacker-controlled release. 5. The malicious package reads inherited environment variables, including avail ...[truncated 806 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `open-websearch@latest` with a reviewed, exact version. Do not use mutable tags in runtime execution paths. 2. Install the dependency during a controlled build or deployment phase rather than downloading it when the Skill runs. 3. Commit and enforce a lockfile, and verify package integrity using the registry-provided integrity digest or an independently maintained checksum. 4. Review the pinned package and its transitive dependencies before deployment. 5. Replace `...process.env` with a minimal allowlist containing only variables required by the subprocess, for example: ```js env: { PATH: process.env.PATH, HOME: process.env.HOME, MODE: 'stdio', DEFAULT_SEARCH_ENGINE: 'duckduckgo', ALLOWED_SEARCH_ENGINES: engines.join(','), } ``` 6. Explicitly exclude `YNOTE_API_KEY`, `PERPLEXITY_API_KEY`, `BRAVE_API_KEY`, and other credentials from the subprocess environment. 7. Where possible, run the fallback provider in a sandbox with restricted filesystem access, network destinations, and process-execution permissions. 8. Fail closed if the pinned and verified fallback component is unavailable instead of silently retrieving a new implementation. ]]>