T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:39
- Finding
- Unpinned and Unverified Third-Party Dependencies## Vulnerability Details **File Location**: `SKILL.md`, lines 39-55 **Vulnerability Type**: Supply-chain exposure through mutable and unverified dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # Install with pip pip install mcp>=1.1.0 python-jobspy>=1.1.82 pandas>=2.1.0 pydantic>=2.0.0 # Or install with uv (faster) uv add mcp python-jobspy pandas pydantic ``` ```bash # Clone the jobspy-mcp-server repository git clone https://github.com/chinpeerapat/jobspy-mcp-server.git cd jobspy-mcp-server # Install dependencies uv sync # or pip install -e . ``` ### Technical Analysis The documented installation commands obtain executable components from mutable external sources without cryptographic integrity verification. The `pip` command uses lower-bound version constraints rather than exact versions, while the `uv add` command does not specify versions at all. Future releases satisfying these constraints may therefore be installed without having been reviewed as part of this audit. Transitive dependencies are also not locked or verified with hashes. The alternative installation procedure clones the default branch of an external personal GitHub repository and immediately installs its dependencies or package. It does not pin the repository to a reviewed commit, verify a signed tag, validate file hashes, or require source review before installation. Consequently, the effective code installed by these instructions can change after the Skill itself has been reviewed. Package installation can invoke build backends, installation hooks, imported setup logic, and subsequently executed server entry points. A malicious or compromised release can therefore run code locally. The unquoted requirement expressions containing `>` should also be corrected. Depending on the invoking shell and parsing context, an expression such as `mcp>=1.1.0` may be interpreted as output redirection rather than being passed intact ...[truncated 1770 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every direct dependency to an exact, reviewed version rather than using lower bounds or unconstrained versions. 2. Generate and commit a lock file that records all transitive dependency versions. 3. Require cryptographic hashes for downloaded packages, such as a hash-locked requirements file installed with `pip --require-hashes`. 4. Pin the external repository to a reviewed full commit SHA instead of cloning and installing its mutable default branch. 5. Prefer signed releases or signed tags, and document how users must verify signatures or checksums before installation. 6. Review package metadata, build configuration, installation hooks, and server entry points before approving dependency updates. 7. Run installation and the MCP server in an isolated virtual environment or container under a dedicated least-privilege account. 8. Restrict the server's filesystem, environment-variable, credential, and network access to what job searching requires. 9. Add automated dependency scanning and scheduled review of lock-file changes. 10. Quote shell requirement specifications, for example: ```bash pip install \ 'mcp==REVIEWED_VERSION' \ 'python-jobspy==REVIEWED_VERSION' \ 'pandas==REVIEWED_VERSION' \ 'pydantic==REVIEWED_VERSION' ``` 11. Replace the mutable clone workflow with explicit checkout and verification steps: ```bash git clone https://github.com/chinpeerapat/jobspy-mcp-server.git cd jobspy-mcp-server git checkout --detach REVIEWED_FULL_COMMIT_SHA git verify-commit REVIEWED_FULL_COMMIT_SHA ``` The verification step should only be relied upon when the expected signing identity and key are independently documented and validated.