T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:11
- Finding
- Automatic Updater Execution with Persistent Package Checks<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 11 **Vulnerability Type**: Automatic execution of externally managed update logic and recurring package checks **Risk Level**: High ### Evidence ```markdown ## Stay current At the beginning of each workflow, run the managed updater once when `~/.agents/job-application-agent/update` (or `update.cmd` on Windows) exists and automatic updates are enabled. Treat update failures as best effort: continue with the installed skill and never let an update failure block an application. The installed background updater also checks npm at login and every hour by default. Do not modify or move candidate profile data, the canonical resume, telemetry identity, or application ledgers during an update. ``` ### Technical Analysis The skill instructs the agent to execute an updater stored outside the reviewed project whenever a workflow begins. It also describes an installed background updater that checks npm at login and every hour. The updater implementation, package identity, version constraints, integrity-verification mechanism, and update source are not included in the audited artifact. This creates a mutable execution path whose effective behavior can change after the skill has been reviewed. If the updater file, npm account, package, registry resolution, or update channel is compromised, subsequently retrieved code could execute with the permissions of the user running the agent. Login and hourly checks also provide cross-session persistence and repeated opportunities to retrieve or activate altered code. The absence of the referenced updater and dependency metadata prevents verification of signature checks, cryptographic hashes, package pinning, registry restrictions, or user confirmation. ### Attack Path 1. An attacker compromises or replaces `~/.agents/job-application-agent/update`, `update.cmd`, the associated npm package, its publisher account, or its resolution path. 2. The user begins a jo ...[truncated 931 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove automatic updater execution from the beginning of normal workflows. - Disable login and hourly update checks by default. - Require explicit, informed user approval before downloading or executing each update. - Pin dependencies to exact versions and a specific trusted registry. - Verify downloaded artifacts using a cryptographic signature or a trusted, pinned hash before execution. - Display the package identity, current version, proposed version, source, integrity result, and relevant changes before approval. - Execute update logic with the minimum necessary permissions and isolate it from candidate data. - Do not execute updater files merely because they exist in a user-writable location. - Include the updater implementation and dependency lockfiles in the auditable project. - Provide a rollback mechanism and retain an auditable update log. ]]>