T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:143
- Finding
- Unpinned Runtime Package Download and Execution< — published by `atxp-dev` | | **Version pinning** | All commands use `npx atxp@latest` for convenience. For stricter supply-chain safety, pin to an exact version (e.g., `npx atxp@1.10.9`) and verify the package checksum with `npm audit signatures`. | | **TypeScript SDK** | [`@atxp/client`](https://www.npmjs.com/package/@atxp/client) — published by `atxp-dev` | | **Source repo** | [github.com/atxp-dev/cli](https://github.com/atxp-dev/cli) | | **Documentation** | [docs.atxp.ai](https://docs.atxp.ai) | | **Service endpoints** | `*.atxp.ai`, `*.mcp.atxp.ai` (HTTPS only) | | **Config file** | `~/.atxp/config` — plain-text KEY=VALUE file, contains `ATXP_CONNECTION` | | **Credentials** | `ATXP_CONNECTION` env var — auth token, treat as secret | | **Network activity** | `npx atxp@latest <cmd>` makes HTTPS requests to `atxp.ai` API endpoints only | | **npm runtime** | `npx atxp@latest` downloads the `atxp` package from the npm registry and caches it in the standard npm/npx cache directory | ``` The same mutable invocation pattern is used throughout the documented workflows, including registration, authentication, wallet operations, paid API calls, email, SMS, voice calls, and contact management. ### Technical Analysis The Skill instructs agents to execute `npx atxp@latest`. This command obtains the package version currently associated with the mutable npm `latest` tag and executes it locally. Consequently, the code executed by the Skill is not fixed to the version that existed when `SKILL.md` was reviewed. Although the document recommends exact-version pinning and signature auditing, its actual command examples continue to use `@latest`. Documentation warnings do not technically ...[truncated 2771 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace every `npx atxp@latest` invocation with an exact, reviewed version, such as: ```bash npx --yes atxp@1.10.9 <command> ``` 2. Verify the selected package release before use: - Validate npm provenance and registry signatures. - Record and verify package integrity hashes. - Compare the published package contents with the referenced source repository. - Audit all transitive dependencies. 3. Introduce a controlled update process: - Review each new package version before changing the pinned version. - Run dependency and malware scanning in CI. - Reject unexpected package ownership, provenance, dependency-tree, or integrity changes. 4. Execute the CLI in a sandbox or isolated container with: - Access only to the required ATXP configuration files. - No access to unrelated workspace, SSH, cloud, or system credentials. - A restricted environment containing only explicitly required variables. - Network egress restricted to verified HTTPS endpoints. - No elevated operating-system privileges. 5. Use a narrowly scoped credential instead of a token granting combined wallet and identity access, if the service supports scoped or short-lived tokens. 6. Enforce human approval and spending limits outside the downloaded package for paid operations, outbound communications, contact synchronization, and other high-impact actions. 7. Update all Quick Start, command-reference, support, and workflow examples so that none silently reintroduce the mutable `@latest` execution pattern. ]]>