T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:33- Finding
Mutable Remote Package Is Downloaded and Executed Without Integrity Verification
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 33-36
Vulnerability Type: Remote payload retrieval and execution through an unpinned external dependency
Risk Level: Highbash ## Setup ```bash pip install https://github.com/Panniantong/agent-reach/archive/main.zip agent-reach install --env=auto agent-reach doctortext ### Technical Analysis The setup instructions install a Python package directly from the mutable `main` branch of a personal GitHub repository. The source is not pinned to an immutable commit or verified with a cryptographic hash or signature. Installing a Python source package may execute attacker-controlled build or installation logic. Immediately afterward, the newly installed `agent-reach` command is invoked with `install --env=auto`. According to the Skill, this command detects the host environment and installs several additional components, including Node.js, mcporter, xreach CLI, GitHub CLI, yt-dlp, and feedparser. Consequently, the effective executable payload and its transitive dependencies can change after this Skill has been reviewed. This behavior exceeds minimum privilege because the Skill delegates broad software installation and environment modification to mutable remote code instead of installing only reviewed, pinned components required for a selected platform. ### Attack Path 1. An attacker compromises the repository owner, the repository, or an upstream dependency selected by its installer. 2. The attacker modifies the `main` branch or package installation logic with a malicious payload. 3. A user or Agent follows the documented setup command. 4. `pip` downloads the current archive and runs applicable package build or installation logic. 5. The resulting `agent-reach` executable runs `install --env=auto`, enabling further downloads and execution. 6. Malicious code executes with the permissions of the user running the Agent and can access that user's fi ...[truncated 616 chars]- Remediation
View remediation
Remediation Suggestions
- Replace the mutable
main.zipinstallation with a reviewed, versioned release from a trusted package registry. - Pin the package to an immutable version or commit and verify it using an approved cryptographic hash or signature.
- Maintain a lockfile or equivalent manifest containing pinned versions and hashes for all transitive dependencies.
- Review and document every component installed by
agent-reach install --env=auto. - Avoid automatic environment-wide installation. Install only the dependencies needed for the platform explicitly requested by the user.
- Present the planned package and system changes and obtain explicit user confirmation before execution.
- Run installation and platform tools in a sandbox or container with restricted filesystem and network access.
- Do not grant administrative privileges unless a specific, documented component strictly requires them.
- Replace the mutable