T08 · Insecure Dependencies
Warning
- Location
- scripts/requirements.txt:1
- Finding
- Unpinned third-party dependencies and package execution<![CDATA[ ## Vulnerability Details **File Location**: `scripts/requirements.txt:1-2`; related instructions at `SKILL.md:140-141` and `reference/evaluation.md:387-392` **Vulnerability Type**: Unpinned dependencies and execution of dynamically resolved packages **Risk Level**: Medium ### Complete Code Snippet ```text anthropic>=0.39.0 mcp>=1.1.0 ``` Related execution instructions: ```bash npm run build npx @modelcontextprotocol/inspector ``` ```bash pip install -r scripts/requirements.txt ``` Or: ```bash pip install anthropic mcp ``` ### Technical Analysis The Python dependency declarations use unrestricted lower bounds rather than exact, reviewed versions. No lock file or package hashes are supplied. Consequently, an installation performed at different times can resolve to materially different dependency versions. The documented `npx @modelcontextprotocol/inspector` command similarly resolves and may download a package version at execution time without identifying an audited version. This creates a mutable supply-chain boundary: code that executes during installation or evaluation is not necessarily the code that existed when the Skill was reviewed. A compromised dependency release, malicious transitive dependency, or unexpectedly incompatible future release could be installed. Python source distributions may execute build-system code during installation, while installed dependencies execute in the evaluation harness when imported. An `npx`-resolved package executes under the invoking user's account. No evidence indicates that the currently named packages are malicious. The vulnerability is the absence of deterministic dependency controls. ### Attack Path 1. An attacker compromises a future release of a direct or transitive dependency, or gains control of its publication channel. 2. A user follows the Skill's documented `pip install` or unversioned `npx` command. 3. The package manager resolves the compromised release because no exact version and in ...[truncated 848 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace open-ended dependency ranges with exact, reviewed versions. 2. Generate and commit a reproducible lock file. 3. Use package hashes, such as a hash-locked requirements file installed with `pip --require-hashes`. 4. Pin the Inspector command to a reviewed version, for example: ```bash npx --yes @modelcontextprotocol/inspector@<reviewed-version> ``` 5. Review and constrain transitive dependencies through a lock-file workflow. 6. Run package installation and evaluation inside an isolated virtual environment or container with minimal filesystem, credential, and network access. 7. Enable automated dependency vulnerability monitoring, but require review before updating locked versions. ]]>