T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:18
- Finding
- Unpinned Remote Repository and Dependency Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 18-21 and 28-35 **Vulnerability Type**: Remote payload retrieval and insecure dependency execution **Risk Level**: High **Vulnerable Code**: ```bash git clone https://github.com/thibautrey/agent-hq.git cd agent-hq npm install npm --prefix frontend-react install ``` ```bash npm --prefix frontend-react run build npm run start:agent-hq ``` ```bash node scripts/jarvis-connector.js ``` ### Technical Analysis The Skill instructs users to clone the mutable default branch of an external Git repository and execute code obtained from it. It does not pin the repository to an immutable commit, verify a cryptographic signature or checksum, or include the referenced source code in the audited package. The subsequent `npm install` operations may execute package lifecycle scripts and resolve third-party dependencies. The project contains no lockfile or dependency manifests that can be audited locally, because only `SKILL.md` is included. The build, server, and connector commands then execute code sourced from the external repository. This creates a time-of-check/time-of-use supply-chain risk: the code reviewed when the Skill is published can differ from the code downloaded when a user follows the instructions. ### Attack Path 1. An attacker compromises the external repository, a maintainer account, or one of its npm dependencies. 2. The attacker adds a malicious lifecycle, build, startup, or connector script to the mutable upstream source. 3. A user follows the Skill instructions and clones the current default branch. 4. `npm install` or `npm --prefix frontend-react install` executes a malicious lifecycle script, or a later build/start command executes the payload. 5. The payload runs with the permissions of the user performing the installation. 6. The payload may read local files and credentials, modify user-accessible resources, initiate network conn ...[truncated 625 chars]
- Remediation
- ## Remediation Suggestions - Pin the repository to a reviewed, immutable commit hash rather than cloning and executing the default branch. - Publish and verify cryptographic checksums or signed release artifacts before execution. - Include the executable implementation in the Skill package so it can be audited with the instructions. - Commit dependency lockfiles and use `npm ci` instead of unconstrained `npm install`. - Review all npm lifecycle scripts and use `npm ci --ignore-scripts` where lifecycle execution is unnecessary. - Pin dependency versions and enable automated dependency integrity and provenance checks. - Run installation and application processes as a dedicated, unprivileged account in an isolated environment. - Require a separate, explicit approval before running downloaded build, startup, or automation scripts.