T03 · Remote Payload Retrieval and Execution
Error
- Location
- scripts/render_mindmap.sh:65
- Finding
- Automatic Retrieval and Execution of an Unpinned npm Package<![CDATA[ ## Vulnerability Details **File Location**: `scripts/render_mindmap.sh`, lines 65–76 **Vulnerability Type**: Mutable remote dependency retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash # Render using mermaid-cli (mmdc) # Priority: global install > local node_modules > npx auto-install if command -v mmdc &> /dev/null; then MMDC_CMD="mmdc" elif [[ -x "./node_modules/.bin/mmdc" ]]; then MMDC_CMD="./node_modules/.bin/mmdc" elif [[ -d "/tmp/mmdc-test/node_modules" ]]; then # Use the local install we set up for testing MMDC_CMD="/tmp/mmdc-test/node_modules/.bin/mmdc" else # Auto-install via npx as last resort MMDC_CMD="npx -y @mermaid-js/mermaid-cli" fi ``` ### Technical Analysis When no existing Mermaid CLI installation is found, the script invokes `npx -y @mermaid-js/mermaid-cli`. This command automatically downloads and executes the package resolved by the npm registry without: - Pinning an exact version - Using a reviewed lockfile - Verifying an integrity hash - Requesting user confirmation - Restricting package lifecycle or runtime behavior Consequently, the effective executable payload can change after the Skill has been reviewed. A compromised package release, maintainer account, registry response, or transitive dependency could introduce arbitrary code that would execute with the permissions and environment of the Agent process. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, or a transitive dependency. 2. The target environment does not have `mmdc` in `PATH` and lacks the expected local installation. 3. A user or Agent triggers mindmap rendering. 4. The renderer selects `npx -y @mermaid-js/mermaid-cli`. 5. `npx` retrieves the current mutable package and its dependency graph from the npm registry. 6. Package installation or runtime code executes under the Agent account. 7. Malicious code can access resources available to that account, including environment vari ...[truncated 685 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove automatic package installation from the runtime path. 2. Pin an exact reviewed version of `@mermaid-js/mermaid-cli` in `package.json`; do not use a floating version or range. 3. Commit and enforce a package lockfile containing integrity metadata. 4. Install dependencies during a controlled build or deployment phase rather than during Skill execution. 5. Invoke only the reviewed local executable, for example: ```bash MMDC_CMD=(./node_modules/.bin/mmdc) if [[ ! -x "${MMDC_CMD[0]}" ]]; then echo "Error: Pinned mermaid-cli dependency is not installed" >&2 exit 1 fi ``` 6. If `npx` must be retained, use `npx --no-install` so it cannot retrieve missing packages. 7. Verify package provenance and integrity in CI, and use dependency scanning and update review procedures. 8. Run the renderer in a restricted environment without credentials and with outbound network access disabled. ]]>