T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:111
- Finding
- Unverified Remote Client Retrieval and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:111-142` **Vulnerability Type**: Remote payload retrieval and supply-chain execution **Risk Level**: High ### Vulnerable Code ```bash git clone https://github.com/autogame-17/evolver.git cd evolver npm install ``` Alternatively: ```bash TAG=$(curl -sL https://api.github.com/repos/autogame-17/evolver/releases/latest | grep '"tag_name"' | cut -d'"' -f4) curl -fsSL -o evolver.zip "https://github.com/autogame-17/evolver/archive/refs/tags/${TAG}.zip" unzip evolver.zip cd evolver-${TAG#v} npm install ``` The downloaded client is then executed continuously: ```bash node index.js --loop ``` ### Technical Analysis The Skill directs users to retrieve code from an external personal GitHub namespace and execute it without pinning an immutable commit or verifying a cryptographic signature or expected checksum. The `git clone` workflow follows the repository's mutable default branch. The archive workflow dynamically resolves the latest release tag through the GitHub API. Consequently, the effective code executed by users can change after the Skill itself has been reviewed. The subsequent `npm install` increases the attack surface because npm packages may run lifecycle scripts during installation. Transitive dependencies can also introduce code that was not directly reviewed. The Skill does not require inspection of the retrieved source, enforcement of a lockfile, disabled lifecycle scripts, or execution inside a restricted sandbox. Although SHA-256 is mentioned for marketplace asset identifiers, those hashes do not authenticate or verify the downloaded Evolver archive or its npm dependencies. ### Attack Path 1. An attacker compromises the `autogame-17/evolver` repository, a maintainer account, a release, or one of its npm dependencies. 2. The attacker modifies the default branch, publishes a malicious latest tag, or introduces a malicious dependency or lifecycle script. 3. A user follows the Skill ...[truncated 1086 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the client to a reviewed, immutable Git commit rather than the default branch or dynamically selected latest tag. 2. Publish signed release artifacts and document the expected SHA-256 checksum or signature fingerprint in the Skill. 3. Verify the checksum or signature before extracting or executing the archive, and fail closed on any mismatch. 4. Commit and review an exact dependency lockfile, then use `npm ci` instead of `npm install`. 5. Use `npm ci --ignore-scripts` where lifecycle scripts are unnecessary. Explicitly audit any lifecycle scripts that must remain enabled. 6. Display the resolved repository, commit, archive hash, and dependency set for user approval before installation. 7. Run the client under a dedicated, unprivileged account or isolated container with a read-only filesystem and narrowly scoped outbound network access. 8. Avoid exposing unrelated repositories, credentials, home-directory files, SSH material, or complete environment variables to the process. 9. Prefer a small, locally reviewed implementation of the documented HTTPS protocol when continuous client functionality is unnecessary. ]]>