T03 · Remote Payload Retrieval and Execution
- Location
:<n> ``` `SKILL.md:212`: ```bash npx -y @life-os/cli skill install ``` `references/commands.md:8-11`: ```markdown - **Invocation**: run via `npx -y @life-os/cli <command> …` (npx fetches the published package on first use; `-y` skips the prompt). The command names below (`config`, `tasks`, …) are the `<command>` argument, e.g. `npx -y @life-os/cli tasks due=today`. ``` ### Technical Analysis The Skill directs the agent to retrieve and execute `@life-os/cli` from the npm registry without specifyi ...[truncated 3270 chars]:66- Finding
Unpinned npm Package Is Retrieved and Executed Non-Interactively with Vault Access
- Content
View full analysis
`. 2. `npx -y @life-os/cli help` is the authoritative command list. ``` `SKILL.md:100-112`: ```bash # every command is invoked as: npx -y @life-os/cli npx -y @life-os/cli config npx -y @life-os/cli tasks [todo|done|all] npx -y @life-os/cli search query= npx -y @life-os/cli read file=|path=npx -y @life-os/cli daily|weekly|monthly|quarterly|yearly npx -y @life-os/cli :read npx -y @life-os/cli :create npx -y @life-os/cli :append content= npx -y @life-os/cli theme:create type=project|area|resource|archive|theme tag= path=
npx -y @life-os/cli append path=
content= npx -y @life-os/cli create path=
[content=] npx -y @life-os/cli task done|todo ref=: ``` `SKILL.md:212`: ```bash npx -y @life-os/cli skill install ``` `references/commands.md:8-11`: ```markdown - **Invocation**: run via `npx -y @life-os/cli …` (npx fetches the published package on first use; `-y` skips the prompt). The command names below (`config`, `tasks`, …) are the `` argument, e.g. `npx -y @life-os/cli tasks due=today`. ``` ### Technical Analysis The Skill directs the agent to retrieve and execute `@life-os/cli` from the npm registry ...[truncated 3143 chars]
- Remediation
View remediation
``` Do not use version ranges or distribution tags such as `latest`. 2. **Enforce dependency integrity** Install through a committed lockfile with npm integrity hashes, or distribute a reviewed binary/package artifact whose checksum or signature is verified before execution. 3. **Avoid automatic confirmation suppression** Remove `-y` from the default instructions. Require explicit user approval before the first package download, after a version change, and before any package-driven Skill update. 4. **Separate installation from routine execution** Install and review the pinned CLI once, then invoke the fixed local executable for normal vault operations. Routine task and note requests should not trigger package resolution from the network. 5. **Protect Skill updates** Require explicit confirmation before running `skill install`. Back up existing Skill files, display the package version and affected paths, and review changes before replacing `SKILL.md` or `references/`. 6. **Apply process-level containment** Run the CLI with access limited to the intended vault rather than the user’s broader filesystem. Restrict outbound network access during vault reads and writes when package retrieval is not required. 7. **Document the trust boundary** Clearly warn that the npm package executes local code and can access vault contents. Document the exact approved version, publisher identity, verification procedure, and update-review process. ]]>