T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:188
- Finding
- Optional Fetch-at-Launch Execution of Unaudited Registry Packages## Vulnerability Details **File Location**: `SKILL.md`, lines 188–199 **Vulnerability Type**: Third-party package supply-chain risk **Risk Level**: Medium ### Vulnerable Code ```markdown **3. Fetch at launch (`uvx` / `npx`).** Convenient, and the weakest of the three: the launcher resolves and executes a package from a public registry every time the client starts. Pinning the version — which the snippets below do — stops it silently moving to a newer release, but it does not protect you from a compromised publisher account or registry. ```json { "mcpServers": { "apiguru": { "command": "uvx", "args": ["apiguru-mcp==1.1.5"] } } } ``` or, with Node instead of Python, `"command": "npx", "args": ["apiguru-mcp@1.1.5"]`. ``` ### Technical Analysis These optional instructions cause `uvx` or `npx` to resolve and execute a package obtained from a public registry whenever the MCP client starts. Version pinning prevents automatic selection of a newer version, but it does not authenticate the selected artifact or protect against compromise of the publisher account, registry, package metadata, or distribution infrastructure. The referenced MCP implementation is not included in this project and is explicitly described as outside the Skill's audit scope. Consequently, its executable behavior cannot be established from the reviewed artifact. Although the documentation acknowledges the risk and presents `scripts/probe.py` as the preferred implementation, the fetch-at-launch examples remain directly actionable and do not enforce artifact hashes or a reviewed lockfile. The core `scripts/probe.py` implementation does not exhibit this issue: it uses the Python standard library, does not download or execute code, limits network requests to fixed Apiguru origins, and refuses redirects. ### Attack Path 1. An attacker compromises the package publisher account, public registry, package artifact, or relevant distribution infrastructur ...[truncated 1116 chars]
- Remediation
- ## Remediation Suggestions 1. Remove fetch-at-launch `uvx` and `npx` configurations from the recommended workflow. 2. Continue to make the reviewed, standard-library-only `scripts/probe.py` implementation the default and supported execution path. 3. If local MCP deployment remains necessary, publish a reviewed lockfile containing hashes for the package and all transitive dependencies. 4. Require installation from an authenticated, controlled artifact source with mandatory integrity verification rather than resolving packages at runtime. 5. Record and verify the exact artifact digest before every deployment or upgrade; a version number alone is insufficient. 6. Separate installation from execution so package review occurs before the component is allowed to run. 7. Execute the MCP component in a sandbox or container with: - no unrelated credentials in its environment; - read-only or narrowly scoped filesystem access; - no host-level administrative privileges; - outbound access restricted to explicitly required Apiguru endpoints; - resource and process limits. 8. Require a new security review whenever the package version, artifact digest, dependencies, permissions, or network destinations change.