T08 · Insecure Dependencies
Warning
- Location
- references/obsidian-cli.md:23
- Finding
- Unverified Third-Party MCP Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `references/obsidian-cli.md:23-46` **Vulnerability Type**: Unverified third-party dependency installation and execution **Risk Level**: Medium ### Vulnerable Code ```markdown If the agent does not have shell access to the `obsidian` binary, ask the user before installing `mcp-obsidian-cli`. Pin a known version: ```bash # Ask the user first, then install a pinned version npm install -g mcp-obsidian-cli@<VERSION> # or npx mcp-obsidian-cli@<VERSION> ``` Configure as an MCP server in the agent only after the user approves: ```json { "mcpServers": { "obsidian": { "command": "npx", "args": ["mcp-obsidian-cli@<VERSION>"], "env": { "OBSIDIAN_VAULT": "<vault-name>" } } } } ``` > **Note:** The Obsidian app must be running for any CLI or MCP command to work. Do not install or execute `mcp-obsidian-cli` without user consent. ``` ### Technical Analysis The skill recommends downloading and executing `mcp-obsidian-cli` from the npm registry. Although it requires user approval and advises pinning a version, it does not identify a reviewed exact version, verify the package publisher or source repository, provide an integrity hash, or define a lockfile or other reproducible verification mechanism. Both documented execution methods introduce supply-chain risk: - `npm install -g` can execute package lifecycle scripts and installs the package into a persistent, user-wide location. - `npx` retrieves and executes package code from the configured npm registry. - The MCP configuration causes the package to be invoked by the agent after configuration, potentially in later sessions. - A placeholder such as `<VERSION>` does not itself establish that the selected release has been reviewed or is trustworthy. User consent reduces the chance of unexpected installation but does not mitigate a compromised release, malicious publisher, registry compromise, dependency confusion, or selection of an uns ...[truncated 1635 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer the official Obsidian CLI and treat the MCP package strictly as a last-resort option. 2. Replace `<VERSION>` with an exact release that has undergone security review; do not use tags or version ranges such as `latest`, `^`, or `~`. 3. Document the verified npm publisher and canonical source repository so users can detect typosquatting or package substitution. 4. Verify the selected package tarball with a published cryptographic digest or npm integrity value before execution. 5. Review the package and its transitive dependency tree for lifecycle scripts, known vulnerabilities, unexpected network activity, and excessive filesystem access. 6. Avoid global installation. Use an isolated temporary environment, dedicated low-privilege account, container, or equivalent sandbox with access limited to the explicitly named vault. 7. Where operationally possible, install with lifecycle scripts disabled and only enable a required script after review. 8. Restrict outbound network access and prevent the MCP process from accessing credentials, unrelated files, and environment variables. 9. Ensure the MCP configuration uses the same reviewed exact version and cannot silently resolve a different release. 10. Document how to remove the MCP configuration and package after the task is complete. ]]>