T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:143- Finding
Unpinned Runtime Package Download and Execution
- Content
View full analysis
` makes HTTPS requests to `atxp.ai` API endpoints only | | **npm runtime** | `npx atxp@latest` downloads the `atxp` package from the npm registry and caches it in the standard npm/npx cache directory | ``` The same mutable invocation pattern is used throughout the documented workflows, including registration, authentication, wallet operations, paid API calls, email, SMS, voice calls, and contact management. ### Technical Analysis The Skill instructs agents to execute `npx atxp@latest`. This command obtains the package version currently associated with the mutable npm `latest` tag and executes it locally. Consequently, the code executed by the Skill is not fixed to the version that existed when `SKILL.md` was reviewed. Although the document recommends exact-version pinning and signature auditing, its actual command examples continue to use `@latest`. Documentation warnings do not technically ...[truncated 2771 chars]- Remediation
View remediation
``` 2. Verify the selected package release before use: - Validate npm provenance and registry signatures. - Record and verify package integrity hashes. - Compare the published package contents with the referenced source repository. - Audit all transitive dependencies. 3. Introduce a controlled update process: - Review each new package version before changing the pinned version. - Run dependency and malware scanning in CI. - Reject unexpected package ownership, provenance, dependency-tree, or integrity changes. 4. Execute the CLI in a sandbox or isolated container with: - Access only to the required ATXP configuration files. - No access to unrelated workspace, SSH, cloud, or system credentials. - A restricted environment containing only explicitly required variables. - Network egress restricted to verified HTTPS endpoints. - No elevated operating-system privileges. 5. Use a narrowly scoped credential instead of a token granting combined wallet and identity access, if the service supports scoped or short-lived tokens. 6. Enforce human approval and spending limits outside the downloaded package for paid operations, outbound communications, contact synchronization, and other high-impact actions. 7. Update all Quick Start, command-reference, support, and workflow examples so that none silently reintroduce the mutable `@latest` execution pattern. ]]>