T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:29
- Finding
- Unpinned npm Package Automatically Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 29-31 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ```json { "command": "npx", "args": ["-y", "mcp-remote", "https://hub.agent3.me/api/mcp"], "env": { "AGENT3_API_KEY": "a2a_your_key_here" } } ``` ### Technical Analysis The recommended configuration invokes `mcp-remote` through `npx -y` without specifying an exact package version. If the package is absent from the local npm cache, `npx` can retrieve the version currently resolved by the configured npm registry and execute it immediately. The `-y` option suppresses the installation confirmation. Consequently, the code executed on a user's system is not immutable at review time. A compromised npm publisher account, malicious future release, registry compromise, or compromised transitive dependency could introduce arbitrary code. This is a supply-chain weakness; the audited document itself contains no confirmed malicious payload. ### Attack Path 1. An attacker compromises the `mcp-remote` package, one of its dependencies, its publisher account, or the package distribution channel. 2. The attacker publishes or causes npm to resolve a malicious package version. 3. A user applies the documented MCP configuration and starts the client. 4. `npx -y` downloads the unpinned package without requesting confirmation. 5. The malicious package executes with the operating-system privileges and environment available to the MCP client. 6. It can attempt to read accessible files and environment variables, alter user-writable data, establish network connections, or misuse credentials available to that process. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the account running the MCP client. The accessible scope may include user-readable files, user-writable configuration, network access, and environment variables inherited by the process. Credentials supplied to or i ...[truncated 315 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `mcp-remote` to a reviewed exact version rather than relying on the registry's current resolution: ```json { "command": "npx", "args": [ "--yes", "mcp-remote@<reviewed-exact-version>", "https://hub.agent3.me/api/mcp" ] } ``` 2. Prefer installing the package in a controlled project with a committed lockfile and verified integrity metadata, then invoke the locally installed executable. 3. Review the pinned package, its install scripts, and its complete transitive dependency tree before deployment. 4. Use an approved registry or internal package mirror with package provenance and integrity verification. 5. Run the MCP process in a sandbox or dedicated low-privilege account with minimal filesystem, environment, and network access. 6. Expose only credentials required for the operation, use a narrowly scoped API key where supported, and rotate the key if package compromise is suspected. 7. Establish a deliberate dependency-update process so new versions are reviewed and tested before adoption.