T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:40
- Finding
- Unverified Third-Party Package and Repository Code Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:40-51`, `SKILL.md:65-71` **Vulnerability Type**: Third-party supply-chain code execution **Risk Level**: Medium ### Vulnerable Code ```bash # Claude Code: claude mcp add plan-to-eat -- npx -y plan-to-eat-mcp@0.7.3 # x-release-please-version # Claude Desktop, Cursor, Windsurf, Cline, Zed — the same stdio block: # "command": "npx", "args": ["-y", "plan-to-eat-mcp@0.7.3"] # x-release-please-version # To skip the per-launch npx resolve, install once and use the # `plan-to-eat-mcp` bin as the command with no args: npm i -g plan-to-eat-mcp@0.7.3 # x-release-please-version ``` ```bash git clone https://github.com/alex-zwingli/plan-to-eat-mcp.git cd plan-to-eat-mcp && npm install && npm run build claude plugin marketplace add "$(pwd)" claude plugin install plan-to-eat@plan-to-eat ``` ### Technical Analysis The documented installation paths download and execute third-party code that is not present in the audited project. The npm path invokes a registry package through `npx` or installs it globally, allowing package code and applicable npm lifecycle scripts to execute with the invoking user's privileges. Although the package version is pinned to `0.7.3`, no expected integrity digest is enforced by these commands. The alternative GitHub path clones the repository's current default branch and runs `npm install` and `npm run build`. It does not check out a reviewed commit or require verification of a signed release tag. Consequently, the code executed through this path may differ from the code that was reviewed when the Skill document was published. The document states that releases use npm trusted publishing and recommends `npm audit signatures`, which reduces risk. However, verification is not made a prerequisite for execution, and the Git clone path remains mutable. This is a supply-chain exposure rather than evidence that the referenced package is currently malicious. ### Attack Path 1. An at ...[truncated 1368 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the Git installation path to a reviewed immutable commit hash or cryptographically signed release tag rather than the mutable default branch. 2. Publish and document the expected npm package integrity digest, and require verification before installation or execution. 3. Make provenance and signature validation a mandatory pre-installation step instead of an optional post-installation recommendation. 4. Prefer installation from a reviewed lockfile with dependency versions and integrity values committed to the trusted project. 5. Run the MCP server in a sandbox or dedicated low-privilege account with access limited to the resources required for Plan to Eat integration. 6. Prevent the MCP process from receiving unrelated environment variables or filesystem access. 7. Use dedicated, revocable Plan to Eat credentials where supported, and rotate them if package or host compromise is suspected. 8. Review package lifecycle scripts and transitive dependencies before installation, and configure npm to suppress unnecessary lifecycle scripts where compatible with the package. ]]>