T08 · Insecure Dependencies
Error
- Location
- SKILL.md:26
- Finding
- Unpinned Third-Party Packages Are Downloaded and Executed Automatically<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 26; the same unpinned execution pattern also appears on lines 14-15, 19, and 23. **Vulnerability Type**: Unpinned and automatically executed third-party dependencies **Risk Level**: High ### Vulnerable Code ```shell npx -y mcporter list --stdio 'uvx mcp-vods' --schema --all-parameters ``` ### Technical Analysis The skill directs the agent to execute `mcporter` using `npx -y` and `mcp-vods` using `uvx`. Neither package is constrained to a reviewed version, immutable artifact, integrity hash, or trusted lockfile. The `-y` option permits `npx` to install the resolved package without interactive confirmation. `uvx` similarly resolves and runs the referenced Python package in an ephemeral environment. Consequently, the code executed at invocation time may differ from the code that existed when the skill was audited. This creates a supply-chain security boundary in which registry publishers, compromised maintainer accounts, dependency trees, and package registries can influence locally executed code. The project contains only `SKILL.md`, so no local implementation is available to validate or constrain the effective runtime behavior. ### Attack Path 1. An attacker compromises the publication account, registry artifact, or transitive dependency of `mcporter` or `mcp-vods`. 2. The attacker publishes a malicious version that remains compatible with the package name used by the skill. 3. A user or agent invokes one of the documented commands. 4. `npx -y` and `uvx` resolve and download the unpinned packages without requiring manual package review. 5. Package installation hooks, startup logic, or MCP server code executes with the permissions of the invoking user. 6. The malicious code can access resources available to that user and communicate through the network unless external sandboxing prevents it. ### Impact Assessment Successful exploitation permits arbitrary code execution with the privil ...[truncated 684 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin both packages to exact, reviewed versions rather than resolving the latest available releases. 2. Record resolved dependencies in lockfiles and require immutable integrity hashes where the package managers support them. 3. Avoid automatic installation through `npx -y`; preinstall verified artifacts from an approved dependency repository. 4. Verify package publisher identity, source repository provenance, release signatures, and the complete transitive dependency graph. 5. Run the MCP process in a sandbox or container with: - A read-only or narrowly scoped filesystem. - A minimal environment-variable allowlist. - No access to credentials or unrelated user files. - Restricted outbound network access. - Local-network access limited to explicitly approved devices. 6. Use a controlled internal mirror and dependency allowlist to prevent dependency confusion or unexpected publisher changes. 7. Add automated dependency scanning and require security review before updating pinned versions. ]]>