T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned Python Package Installation and Upgrade<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 8–10 and 42–44 **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Medium ### Vulnerable Code ```markdown mcptoon is a zero-dependency CLI. If it is not installed yet, one command sets it up: `pip install mcptoon` (128KB, installs in seconds, nothing else pulled in). It gives you a compressed view of the user's MCP tools and calls them back. ``` ```markdown ## Setup - Install/upgrade: `pip install --upgrade mcptoon` (zero-dependency wheel, 128KB, installs in seconds). - Diagnose: `mcptoon doctor`. ``` ### Technical Analysis The skill instructs users or agents to install the latest package available under the `mcptoon` name and later upgrade it without specifying a reviewed version, cryptographic hash, lock file, package signature, or verified source repository. Consequently, the installed code is not immutable relative to the audited skill. A future package release, compromised publisher account, or package-registry compromise could cause these commands to install code that differs from the version originally intended or reviewed. The use of `--upgrade` further increases exposure by replacing an existing installation with the latest available release. Python package installation may also invoke package-controlled build or installation behavior, depending on the package format and installer environment. ### Attack Path 1. An attacker compromises the package publisher account or the relevant package-registry distribution channel. 2. The attacker publishes a malicious release under the expected `mcptoon` package name. 3. A user or agent follows the skill instruction and runs `pip install mcptoon` or `pip install --upgrade mcptoon`. 4. The package manager retrieves and installs the attacker-controlled release because no version or hash is pinned. 5. The malicious package executes during installation or when the documented CLI is subsequently invoked. 6 ...[truncated 665 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the package to a specifically reviewed version, for example: ```bash python -m pip install "mcptoon==<reviewed-version>" ``` 2. Publish and verify cryptographic hashes through a locked requirements file: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Identify the authoritative source repository and package publisher in the skill documentation. 4. Verify release signatures, provenance attestations, or trusted-publisher metadata where available. 5. Remove the unconditional upgrade recommendation. Require review and approval before changing the installed version. 6. Prefer installation in an isolated virtual environment with only the permissions required for MCP operations. 7. Document the exact package version to which the skill’s behavioral and security claims apply. ]]>