T03 · Remote Payload Retrieval and Execution
- Location
SKILL.md:17- Finding
Mutable Remote Package Is Automatically Retrieved and Executed During Skill Loading
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:17-22
Vulnerability Type:T03: Remote Payload Retrieval and Execution, T08: Insecure Dependencies
Risk Level: MediumComplete Code Snippet
markdown > **IMPORTANT:** Run all CLI commands using the project's package runner: `npx shadcn@latest`, `pnpm dlx shadcn@latest`, or `bunx --bun shadcn@latest` — based on the project's `packageManager`. Examples below use `npx shadcn@latest` but substitute the correct runner for the project. ## Current Project Context ```json !`npx shadcn@latest info --json 2>/dev/null || echo '{"error": "No shadcn project found. Run shadcn init first."}'`text The same mutable package-execution policy is reiterated at `cli.md:3-5`: ```markdown Configuration is read from `components.json`. > **IMPORTANT:** Always run commands using the project's package runner: `npx shadcn@latest`, `pnpm dlx shadcn@latest`, or `bunx --bun shadcn@latest`. Check `packageManager` from project context to choose the right one. Examples below use `npx shadcn@latest` but substitute the correct runner for the project.Technical Analysis
The Skill instructs the agent to download and execute the mutable
latestrelease of theshadcnpackage. More significantly, the dynamic context directive atSKILL.md:22can invoke that package when the Skill context is loaded, rather than only after a user explicitly requests a modifying operation.Package runners such as
npx,pnpm dlx, andbunxretrieve executable package content from an external package registry when the requested version is not already available locally. The@latesttag is mutable, so the effective executable payload can change after this Skill has been reviewed. Consequently, auditing the Skill package does not establish what code will execute in future sessions.Project inspection is legitimate for the declared functionality, but automatically executing an unpinned re ...[truncated 1755 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace every
shadcn@latestreference with an exact, reviewed version such asshadcn@X.Y.Z. - Pin and verify dependency integrity through a lockfile, package-manager integrity metadata, or an equivalent trusted digest.
- Do not execute the package automatically while loading Skill context. Use static project-file inspection where possible, or request explicit user approval before first-time network retrieval and execution.
- Prefer a project-local, lockfile-pinned CLI dependency over ephemeral
npx,pnpm dlx, orbunxexecution. - Display the resolved package name, version, source registry, and intended command before execution.
- Run the CLI in a restricted environment with only the project directory mounted, minimal environment variables, no unrelated credentials, and constrained outbound network access.
- Establish a controlled upgrade process in which new CLI versions are reviewed and tested before the pinned version is changed.
- Replace every