T08 · Insecure Dependencies
Warning
- Location
scripts/requirements.txt:1- Finding
Unpinned third-party dependencies and package execution
- Content
View full analysis
=0.39.0 mcp>=1.1.0 ``` Related execution instructions: ```bash npm run build npx @modelcontextprotocol/inspector ``` ```bash pip install -r scripts/requirements.txt ``` Or: ```bash pip install anthropic mcp ``` ### Technical Analysis The Python dependency declarations use unrestricted lower bounds rather than exact, reviewed versions. No lock file or package hashes are supplied. Consequently, an installation performed at different times can resolve to materially different dependency versions. The documented `npx @modelcontextprotocol/inspector` command similarly resolves and may download a package version at execution time without identifying an audited version. This creates a mutable supply-chain boundary: code that executes during installation or evaluation is not necessarily the code that existed when the Skill was reviewed. A compromised dependency release, malicious transitive dependency, or unexpectedly incompatible future release could be installed. Python source distributions may execute build-system code during installation, while installed dependencies execute in the evaluation harness when imported. An `npx`-resolved package executes under the invoking user's account. No evidence indicates that the currently named packages are malicious. The vulnerability is the absence of deterministic dependency controls. ### Attack Path 1. An attacker compromises a future release of a direct or transitive dependency, or gains control of its publication channel. 2. A user follows the Skill's documented `pip install` or unversioned `npx` command. 3. The package manager resolves the compromised release because no exact version and in ...[truncated 848 chars]- Remediation
View remediation
``` 5. Review and constrain transitive dependencies through a lock-file workflow. 6. Run package installation and evaluation inside an isolated virtual environment or container with minimal filesystem, credential, and network access. 7. Enable automated dependency vulnerability monitoring, but require review before updating locked versions. ]]>