T03 · Remote Payload Retrieval and Execution
- Location
SKILL.md:366- Finding
Unverified Remote Payload Retrieval and Continuous Execution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 366-380
Vulnerability Type: Remote code retrieval and execution without integrity verification
Risk Level: Highbash git clone https://github.com/autogame-17/evolver.git cd evolver npm install node index.js --loopbash TAG=$(curl -sL https://api.github.com/repos/autogame-17/evolver/releases/latest | grep '"tag_name"' | cut -d'"' -f4) curl -fsSL -o evolver.zip "https://github.com/autogame-17/evolver/archive/refs/tags/${TAG}.zip" unzip evolver.zip cd evolver-${TAG#v} npm install node index.js --loopTechnical Analysis
The Skill instructs users to retrieve mutable source code from an external, personal GitHub repository and execute it locally. The clone workflow does not pin a reviewed commit, while the archive workflow dynamically resolves the latest release tag. Neither workflow verifies a cryptographic checksum or signature before execution.
Although the downloaded ZIP contains source code rather than a native binary, it is an executable payload because the instructions subsequently invoke
npm installandnode index.js --loop. Package installation may also execute dependency lifecycle scripts. Consequently, the code that ultimately runs can change after the Skill itself has been audited.The network download is relevant to the advertised optional Evolver client, but executing an unverified client continuously is not the minimum privilege necessary to use the documented EvoMap HTTP protocol. Direct, user-approved API operations can provide the core functionality with substantially less supply-chain exposure.
Attack Path
- An attacker compromises the referenced GitHub account, repository, release tag, or one of the client's resolved dependencies.
- The attacker modifies the client, package metadata, dependency graph, or an installation lifecycle script.
- A user follows the Skill's instructions and retrieves t ...[truncated 1238 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin the client to a specific, reviewed commit rather than cloning the repository's mutable default branch or dynamically selecting the latest release.
- Publish release artifacts with SHA-256 checksums and a verifiable maintainer signature. Verify both before extracting or executing the artifact.
- Commit and review an exact dependency lockfile. Use
npm cirather than unconstrained dependency installation. - Use
npm ci --ignore-scriptswhere functionality permits. If lifecycle scripts are necessary, document and review each required script before allowing execution. - Run the client in a restricted container or sandbox with a dedicated unprivileged account, a read-only filesystem where practical, no inherited secrets, and narrowly scoped outbound network access.
- Require explicit user approval before installing the external client or enabling
--loop; do not present continuous execution as necessary for basic protocol access. - Prefer implementing the required HTTPS protocol calls directly in a reviewed local component when only registration, publishing, or fetching is needed.
- Document the data and filesystem resources the external client requires, and deny access to credentials, unrelated repositories, home-directory data, and privileged sockets by default.