T08 · Insecure Dependencies
Error
- Location
- SKILL.md:22
- Finding
- Unpinned Third-Party Package Download and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 22-25 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code Snippet ```markdown 1. **Setup (First Time Only)** - Check if the `stitch` server is configured in `mcporter`. - If not, configure it: `mcporter config add stitch --command "npx" --args "-y stitch-mcp-auto"` - Ensure the user is authenticated with Google Cloud (the tool may prompt for `gcloud auth`). ``` ### Technical Analysis The Skill directs `mcporter` to register and execute `npx -y stitch-mcp-auto` without specifying an exact package version. `npx` may obtain the package dynamically from the configured npm registry, while `-y` suppresses the package-installation confirmation. Consequently, the code executed during setup is not immutable relative to the reviewed Skill. A future release of the package—or a release produced after compromise of its publisher or distribution channel—could execute arbitrary JavaScript, package lifecycle hooks, or subprocesses under the Agent user's account. No version lock, integrity hash, trusted-source validation, or isolation control is documented. The package download is functionally relevant because the Skill requires a Stitch MCP implementation. However, automatically downloading and executing an unpinned version exceeds the minimum safe supply-chain privileges needed to provide that functionality. ### Attack Path 1. An attacker compromises the `stitch-mcp-auto` package, its publisher account, or a relevant package-distribution channel. 2. The attacker publishes a malicious version under the package name expected by the Skill. 3. A user performs the Skill's first-time setup. 4. The documented command causes `npx -y` to download the currently resolved package version without an interactive confirmation. 5. Attacker-controlled package or lifecycle code executes with the permissions of the Agent user. 6. That code may inspect o ...[truncated 1117 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `stitch-mcp-auto` to an exact, reviewed version instead of resolving the latest release, for example: ```text mcporter config add stitch --command "npx" --args "-y stitch-mcp-auto@1.2.3" ``` 2. Verify that the package name, publisher, repository, and distribution source are official and explicitly document those identifiers. 3. Use a lockfile and npm integrity metadata where the deployment model permits it. Prefer installation from a reviewed dependency manifest over dynamic execution through `npx -y`. 4. Re-audit package updates before changing the pinned version. 5. Avoid suppressing installation confirmation unless required for controlled automation. 6. Run the MCP package in an isolated, least-privileged environment with restricted filesystem, environment-variable, credential, and network access. 7. Provide only narrowly scoped Google Cloud credentials and IAM roles required for Stitch operations. Do not expose unrelated cloud credentials to the MCP process. 8. Consider maintaining a verified internal package mirror or approved artifact with integrity checks for reproducible deployment.