T08 · Insecure Dependencies
Error
- Location
- SKILL.md:33
- Finding
- Unpinned Third-Party MCP Package Is Granted Access to a Solana Keypair<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:33-49`; duplicated in `llms.txt:51-67` **Vulnerability Type**: Unpinned executable dependency with access to private signing material **Risk Level**: High ### Vulnerable Code ```json { "mcpServers": { "pokeperps": { "command": "npx", "args": ["@pokeperps/mcp"], "env": { "POKEPERPS_KEYPAIR": "/path/to/your/keypair.json" } } } } ``` The corresponding environment-variable documentation confirms that the value is a path to a Solana keypair: ```markdown | `POKEPERPS_KEYPAIR` | Path to Solana keypair JSON | (none - read-only mode) | ``` The same configuration is repeated in `llms.txt`: ```json { "mcpServers": { "pokeperps": { "command": "npx", "args": ["@pokeperps/mcp"], "env": { "POKEPERPS_KEYPAIR": "/path/to/keypair.json" } } } } ``` ### Technical Analysis The recommended configuration runs `@pokeperps/mcp` through `npx` without an exact package version, package lockfile, integrity hash, or locally auditable implementation. Depending on the local npm configuration and cache state, `npx` can retrieve and execute the current registry release at invocation time. In execution mode, the launched package receives the filesystem path of a Solana keypair. Because the package runs with the invoking user's permissions, it can normally read the referenced file directly. It also has the network access required by the Skill. A compromised maintainer account, malicious package update, registry compromise, or unexpected future release could therefore access and transmit the private key or use it to sign transactions. The wallet capability is necessary for unattended trading as currently designed, but exposing raw private-key material to a remotely mutable dependency is not the minimum privilege necessary. An external wallet or narrowly scoped signing interface could authorize individual transactions without giving the MCP ...[truncated 1438 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the MCP dependency to an exact reviewed version rather than using `"@pokeperps/mcp"` without a version. 2. Distribute and install it through a lockfile with verified integrity hashes instead of dynamically resolving it during each `npx` invocation. 3. Publish the MCP source and reproducible-build information so users can verify that the distributed artifact matches reviewed code. 4. Do not expose raw keypair files to the MCP process. Prefer an interactive Solana wallet, hardware wallet, remote signer, or capability-limited signing service that displays and approves each transaction. 5. If unattended signing is unavoidable, use a dedicated low-balance wallet with no unrelated assets or authorities. 6. Run the MCP server in a sandbox with restricted filesystem access and an outbound-network allowlist. 7. Require explicit user confirmation for deposits, withdrawals, and position changes. Display the program ID, token mint, destination accounts, amounts, leverage, and fees before signing. 8. Document package provenance and the exact supported version in both `SKILL.md` and `llms.txt`. ]]>