T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:18
- Finding
- Mutable Remote MCP Instructions Fall Outside the Static Audit Boundary## Vulnerability Details **File Location**: `SKILL.md`, lines 18-39 and 44-53 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown - **The operations this entry exposes** — the command surface, the delivery boundary, and the sequencing above them: which call answers a question, where exactly one confirmation stands before a write, and how to read a refusal. Their own descriptions, and the `coach_orchestration` prompt served beside them, are canonical for all of it. - **The field descriptions in what comes back** — where a field carries one, read it rather than inferring from the name; it is canonical and this file will not repeat it. Coverage is partial: most response fields are typed and undescribed today, so a name you cannot read confidently is an unknown to say out loud, never a meaning to guess at. - **The training judgment** — cycle direction, week arrangement, anchors, progression, evidence quality. It comes back in full as `coaching_guidance` every time the plan is refreshed (step 1 below), so it is already in hand before the first coaching turn: coach from it there rather than looking for it. The `coach_training_judgment` prompt still serves the same text for a client that would rather fetch it separately. It travels with the product rather than living here so that a client reaching this product any other way coaches from the same text, instead of the sequencing alone. **If those operations are not in front of you, the Skill is installed and the coach is not connected.** This file is instructions and nothing else. The plan, the evidence, and every operation named above arrive over a connection, so until one exists there is nothing to read a plan from. Making it is two steps: point this client at the coach's MCP server -- https://mcp.paceandstaystrong.com/mcp, or the athlete's own gateway if they run on ...[truncated 3421 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the MCP protocol, operation schema, and instruction bundle to an explicit reviewed version rather than accepting mutable canonical content. 2. Include the security-critical orchestration and authorization rules in the audited package, especially confirmation requirements and write boundaries. 3. Authenticate the MCP endpoint and verify the integrity of returned instruction bundles using signatures or cryptographic hashes. 4. Define a strict allowlist of permitted MCP operations, parameters, provider resources, and response types in the client. 5. Apply least-privilege provider scopes, separating read-only evidence access from plan or calendar write access where supported. 6. Treat remotely returned prompts and guidance as untrusted data that cannot override system, developer, user, authorization, or safety constraints. 7. Validate every state-changing operation locally and retain the explicit user-confirmation requirement independently of remote orchestration text. 8. Display the selected MCP host and requested authorization scopes before connection, particularly when an athlete-operated gateway is used. 9. Maintain auditable version and integrity metadata for the remote guidance used during each planning or write operation. 10. Fail closed if the remote schema, signature, host identity, or instruction version is unknown or differs from the approved configuration.