T08 · Insecure Dependencies
Error
- Location
- SKILL.md:15
- Finding
- Unpinned Runtime Dependency Executes Mutable External Code with Wallet Credentials## Vulnerability Details **File Location**: `SKILL.md`, lines 15-32 **Vulnerability Type**: Unpinned runtime dependency and supply-chain exposure **Risk Level**: High **Vulnerable Code Snippet**: ```markdown ## Before you install - **Credentials:** Signing keys and RPC endpoints are supplied by you (see *Credentials and environment* below). Never paste private keys into a UI or an env var you don’t control. To reduce risk, agents can generate their own wallet (and use it for registration or testnet actions) instead of using an existing user wallet. Ask the skill author or [documentation](https://github.com/bnb-chain/bnbchain-mcp) how they are stored and who can access them. - **Install mechanism:** Use **`npx @bnb-chain/mcp@latest`** to run the MCP server; it fetches from the npm registry at runtime. If you prefer to audit first, install the package locally and review the [source code](https://github.com/bnb-chain/bnbchain-mcp) before use. - **Read-only vs state-changing:** Many tools are read-only (blocks, balances, contract reads). Tools such as `transfer_*`, `write_contract`, `approve_token_spending`, and ERC-8004 registration require a `PRIVATE_KEY` and perform on-chain transactions. If you want read-only use only, do not supply a private key and avoid invoking state-changing tools. - **Sandbox and testnet:** Run in a restricted environment when possible. Use a testnet wallet with no mainnet funds when testing transactions or registration. - **Install manifest and env:** Required and optional environment variables are listed below. Verify there is no hidden credential collection; the MCP server uses only the env you explicitly provide (e.g. in your MCP client config). --- ## 1. How to connect Use **`npx @bnb-chain/mcp@latest`** to connect to the BNB Chain MCP server. --- ## 2. Credentials and environment - **RPC / network:** The MCP server uses public or configured RPC endpoints for supported chains (BSC, opBNB, Gre ...[truncated 3546 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `npx @bnb-chain/mcp@latest` with an exact, reviewed version such as `npx @bnb-chain/mcp@1.0.2`, subject to verification that this is the intended release. 2. Commit a lockfile and verify npm integrity metadata or a cryptographic digest before execution. Avoid mutable tags and unconstrained transitive dependencies. 3. Audit the exact package source and dependency tree before allowing it to receive a private key. Repeat the review before upgrading. 4. Prefer a local, reproducible installation using `npm ci` rather than downloading the effective runtime payload on every invocation. 5. Run the MCP server in a restricted sandbox with minimal filesystem access, a constrained environment, and network egress limited to required RPC and service endpoints. 6. Do not expose a private key for read-only use. For writes, use a dedicated low-value wallet with only the permissions and funds needed for the requested operation. 7. Prefer testnet wallets during evaluation. Keep production wallets and unrelated secrets outside the MCP process environment. 8. Require explicit user confirmation of the network, recipient, amount, contract address, function, approval limit, fees, and transaction calldata immediately before every state-changing operation. 9. Reconcile the `SKILL.md` version (`1.0.2`) with `_meta.json` (`1.0.0`) so users can reliably identify the reviewed Skill release.