T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:22
- Finding
- Unpinned Remote Repository Is Downloaded, Installed, and Executed## Vulnerability Details **File Location**: `SKILL.md:22-26` **Vulnerability Type**: Remote payload retrieval and supply-chain execution **Risk Level**: High **Vulnerable Code:** ```bash git clone https://github.com/zxcnny930/buzz.git cd buzz npm install cp config.example.json config.json npm start ``` ### Technical Analysis The installation instructions clone the current state of an external GitHub repository without pinning or verifying a commit, tag, signature, or content digest. The effective code executed by the Skill can therefore change after this package has been reviewed. Running `npm install` also resolves and installs the remote project's dependency graph and may execute npm lifecycle scripts. The subsequent `npm start` executes code from the unaudited repository. Neither the remote implementation nor its dependency lockfile is included in the audited artifact, so its integrity and behavior cannot be established from the packaged files. This creates a remote payload execution and supply-chain trust boundary: control of the referenced repository, its maintainer account, or a dependency used by that repository may translate into local code execution. ### Attack Path 1. An attacker compromises the referenced GitHub repository, its maintainer account, or an install-time dependency. 2. The attacker adds malicious application code, an npm lifecycle script, or a compromised dependency release. 3. A user or Agent follows the documented setup procedure and clones the mutable repository state. 4. `npm install` executes any applicable lifecycle scripts and installs the attacker-controlled dependency graph. 5. `npm start` executes the downloaded application code. 6. The malicious code runs with the operating-system privileges and environment access of the invoking user or Agent. ### Impact Assessment Successful exploitation can provide arbitrary code execution within the invoking process's privilege boundar ...[truncated 646 chars]
- Remediation
- ## Remediation Suggestions 1. Include the reviewed implementation directly in the Skill package so the audited artifact matches the executed code. 2. If remote retrieval is unavoidable, check out a specific immutable commit hash rather than the repository's default branch. 3. Verify the downloaded source using an authenticated signature or a trusted cryptographic digest before installation or execution. 4. Include and review a dependency lockfile, then use `npm ci` to enforce the locked dependency graph. 5. Use `npm ci --ignore-scripts` where lifecycle scripts are unnecessary. If scripts are required, review and explicitly permit each required script. 6. Apply dependency integrity verification, vulnerability scanning, and provenance controls before deployment. 7. Run installation and the service under a dedicated, unprivileged account with minimal filesystem access. 8. Restrict outbound network access to the destinations required for the documented news and notification functionality. 9. Keep secrets outside the source tree and expose only the credentials required by the running service.