T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:51
- Finding
- Unpinned Third-Party Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 51–54 **Vulnerability Type**: Unpinned external dependency installation and execution **Risk Level**: Medium ### Vulnerable Code ```bash pip install spatix-mcp # or uvx spatix-mcp ``` ### Technical Analysis The documentation instructs users to install or immediately execute `spatix-mcp` from an external package registry without specifying an exact version or verifying an integrity hash. Because dependency resolution selects the currently available package release, the effective code can change after this skill has been reviewed. The `uvx` command is particularly sensitive because it resolves the external package and runs its executable directly. The MCP implementation is not included in the audited artifact, so its runtime behavior cannot be verified as part of this audit. This finding does not establish that the current package is malicious. It identifies a supply-chain trust weakness through which a compromised publisher account, registry compromise, or malicious future release could introduce attacker-controlled code. ### Attack Path 1. An attacker compromises the package publisher account, package registry, or release process for `spatix-mcp`. 2. The attacker publishes a malicious release under the expected package name. 3. A user follows the documented `pip install spatix-mcp` or `uvx spatix-mcp` instruction. 4. The package manager resolves the attacker-controlled release because no reviewed version or integrity hash is required. 5. Installation hooks or the package executable run with the permissions of the invoking user. 6. The malicious package accesses resources available to that user or performs additional unauthorized actions. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the user running the installation or MCP server. Depending on that user's environment, exposed resources could include local files, environment vari ...[truncated 360 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an exact version that has been reviewed, for example: ```bash pip install spatix-mcp==REVIEWED_VERSION uvx spatix-mcp==REVIEWED_VERSION ``` 2. Publish trusted cryptographic hashes and require hash verification during installation, such as through a locked requirements file used with `pip --require-hashes`. 3. Maintain a dependency lock file or equivalent reproducible environment so installations cannot silently resolve newer releases. 4. Avoid recommending implicit latest-version execution through `uvx`. 5. Verify package provenance, publisher identity, release signatures, and source-to-package correspondence before approving upgrades. 6. Run the MCP server with least privilege in an isolated environment that does not expose unnecessary files, secrets, environment variables, or host tools. 7. Re-audit each dependency update before changing the documented pinned version.