T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:18
- Finding
- Execution of Unpinned Code from a Mutable Remote Repository## Vulnerability Details **File Location**: `SKILL.md`, lines 18-22 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```bash # Clone the project git clone https://github.com/yes999zc/gateway-monitor.git cd gateway-monitor # Run directly without dependencies node server.js ``` ### Technical Analysis The installation instructions clone the default branch of an external Git repository and immediately execute `server.js`. Neither an immutable commit nor a release tag, checksum, or cryptographic signature is specified. The audited artifact contains only `SKILL.md` and `skill.yaml`; it does not contain the referenced `server.js`. Therefore, the effective executable payload cannot be reviewed from this artifact and may change after the Skill has been audited. A compromise of the repository, transfer of repository ownership, or malicious update to its default branch could cause future users to execute different code from the code originally intended. ### Attack Path 1. An attacker compromises the remote repository, its maintainer account, or another mechanism capable of changing its default branch. 2. The attacker modifies `server.js` or another file loaded by it. 3. A user follows the documented installation procedure without pinning a reviewed revision. 4. `git clone` retrieves the attacker-controlled version. 5. `node server.js` executes the modified payload with the invoking user's permissions. 6. If the optional LaunchAgent installation is subsequently performed, the payload may also obtain recurring cross-session execution. ### Impact Assessment The remote code receives the operating-system permissions of the user who starts Node.js. Depending on those permissions and the unknown implementation, it could access user-readable files, gateway logs and configuration, local credentials available to the process, network services, and service-management interfa ...[truncated 446 chars]
- Remediation
- ## Remediation Suggestions - Include all reviewed runtime source files in the distributed Skill artifact. - If remote retrieval remains necessary, pin installation to an immutable Git commit rather than the default branch. - Publish and verify a cryptographic checksum or signed release before execution. - Separate retrieval from execution so users can inspect and approve the downloaded files. - Document the exact reviewed commit and reject execution when the checked-out revision differs. - Apply restrictive filesystem and network permissions to the monitoring process and avoid exposing credentials through its environment unless strictly necessary.