T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:49- Finding
Mutable npm Package Is Downloaded and Executed Without Version Pinning
- Content
View full analysis
--output /tmp/-analysis.xml ``` Always output to a temporary directory (`/tmp` on Unix, `%TEMP%` on Windows) for remote repositories to avoid polluting the user's working directory. ### Pack a Local Directory ```bash npx repomix@latest [directory] --output /tmp/-analysis.xml ``` ``` The same mutable package reference is repeated later: ```bash # Remote repository (always output to /tmp) npx repomix@latest --remote yamadashy/repomix --output /tmp/repomix-analysis.xml # Large remote repo with compression npx repomix@latest --remote facebook/react --compress --output /tmp/react-analysis.xml # Local directory npx repomix@latest ./src --output /tmp/src-analysis.xml # Specific file types only npx repomix@latest --include "**/*.{ts,tsx,js,jsx}" --output /tmp/filtered-analysis.xml ``` The installation metadata also omits a fixed version: ```yaml install: - kind: node package: repomix bins: - repomix label: "Install Repomix CLI (npm)" ``` ### Technical Analysis The Skill instructs the agent to invoke `npx repomix@latest`. The `latest` npm distribution tag is mutable and may resolve to a different package version each time the command is run. If the requested package is not already available locally, `npx` can retrieve it from the configured npm registry and execute its package code, including installation lifecycle behavior. As a result, the effective executable payload is not fixed to the version reviewed during this audit. A future compromised or malicious release could therefore introduce arbitrary behavior without any modification to `SKILL.m ...[truncated 1955 chars]- Remediation
View remediation
--output /tmp/-analysis.xml ``` 2. Pin the package version in the Skill installation metadata rather than declaring only `repomix`. 3. Use a lockfile and npm integrity hashes where the surrounding Skill platform supports them. Install dependencies with deterministic mechanisms such as `npm ci`. 4. Review the selected package version and its dependency tree before updating it. Treat upgrades as security-relevant changes requiring a new audit. 5. Configure npm to use an approved registry and retain registry integrity verification. In higher-security environments, use an internal mirror containing only reviewed artifacts. 6. Disable unnecessary npm lifecycle scripts where compatible with the package, such as by using `--ignore-scripts`, after confirming that doing so does not break legitimate functionality. 7. Execute repository-packaging tools with least privilege in an isolated environment. Restrict access to unrelated files, sensitive environment variables, credentials, and outbound network destinations. 8. Do not rely solely on Repomix's automatic secret filtering. Explicitly limit included paths and inspect generated output before transmitting or sharing it. ]]>