T08 · Insecure Dependencies
Error
- Location
- SKILL.md:42
- Finding
- Unpinned Third-Party Package Is Downloaded and Executed Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 42-66 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code ```bash echo '{\"name\":\"list_markets\",\"arguments\":{\"layer\":\"Lab\",\"status\":\"Active\"}}' | npx @baozi.bet/mcp-server ``` ```bash echo '{\"name\":\"list_race_markets\",\"arguments\":{\"layer\":\"Lab\",\"status\":\"Active\"}}' | npx @baozi.bet/mcp-server ``` ```bash echo '{\"name\":\"get_market\",\"arguments\":{\"market\":\"MARKET_PUBKEY\"}}' | npx @baozi.bet/mcp-server ``` ```bash echo '{\"name\":\"get_quote\",\"arguments\":{\"market\":\"MARKET_PUBKEY\",\"side\":\"Yes\",\"amount\":1.0}}' | npx @baozi.bet/mcp-server ``` ```bash echo '{\"name\":\"get_positions\",\"arguments\":{\"wallet\":\"WALLET_ADDRESS\"}}' | npx @baozi.bet/mcp-server ``` ```bash echo '{\"name\":\"analyze-market\",\"arguments\":{\"market\":\"MARKET_PUBKEY\"}}' | npx @baozi.bet/mcp-server ``` ### Technical Analysis Every documented operation invokes `npx @baozi.bet/mcp-server` without specifying an exact package version. Depending on the local npm configuration and cache state, `npx` can retrieve the version currently selected by the package registry and execute its lifecycle scripts and program code immediately. The reviewed project contains no local copy of the MCP server source, dependency manifest, lockfile, or integrity metadata. Consequently, the code that ultimately executes is mutable after this Skill has been reviewed and cannot be verified from the project contents. This is particularly sensitive because the package is presented as an interface to a cryptocurrency prediction market. Although `SKILL.md` states that the agent builds transactions and the user signs them, the external package implementation was not included in the audit. The stated separation therefore cannot be independently confirmed from the reviewed artifact. ### Attack Path 1. An attacker compromises the package pub ...[truncated 1753 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the package to a reviewed, exact version rather than using a floating package reference, for example: ```bash npx --no-install @baozi.bet/mcp-server ``` Install the exact approved version separately through a locked dependency manifest. 2. Add `package.json` and a committed lockfile containing the expected resolved version and integrity hash. Use lockfile-enforced installation such as: ```bash npm ci --ignore-scripts ``` 3. Audit the pinned MCP server source and its transitive dependencies before deployment. Re-audit deliberately before upgrading the pinned version. 4. Disable unnecessary npm lifecycle scripts. If lifecycle scripts are required, document and review each one rather than allowing them implicitly. 5. Run the MCP server in a restricted environment with: - Minimal filesystem access - No private keys or wallet seed phrases - A tightly filtered environment - Restricted outbound network access - No elevated operating-system privileges - Resource and execution-time limits 6. Display the complete serialized transaction and human-readable interpretation before requesting a signature. Independently verify the program ID, instruction type, account addresses, token or SOL amount, fees, and recipient accounts against trusted data. 7. Require explicit user approval for every state-changing action, including the automatic affiliate registration described in `SKILL.md`. Read-only requests must not trigger registration or other blockchain writes. 8. Publish reproducible-build information, checksums, and provenance attestations for the approved MCP server artifact. Verify these controls during installation and startup. ]]>