T08 · Insecure Dependencies
Error
- Location
- SKILL.md:45
- Finding
- Unpinned Package Is Downloaded and Executed Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 45-54 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```json { "mcpServers": { "pipeworx-fda": { "command": "npx", "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/fda/mcp"] } } } ``` ### Technical Analysis The MCP configuration invokes `npx` with both the automatic-confirmation option (`-y`) and the mutable dependency version `mcp-remote@latest`. Consequently, use of this configuration can download and execute package code that was not present in the audited project and whose contents may change after the Skill has been reviewed. The `latest` tag does not identify an immutable artifact. If the package, its publishing account, the package registry, or a transitive dependency is compromised, a malicious release can become the code executed by this configuration. Automatic confirmation also removes an opportunity for the user to inspect and approve the exact package version before execution. Although this is primarily an insecure dependency issue, it also establishes a remote, mutable code-execution channel. The project does not provide a lockfile, integrity hash, package provenance check, or other mechanism that constrains the downloaded payload. ### Attack Path 1. An attacker compromises the `mcp-remote` package, a maintainer account, the distribution registry, or a dependency used by a future release. 2. The attacker publishes a malicious release and causes it to resolve through the `latest` tag. 3. A user activates the documented MCP configuration. 4. `npx -y` downloads the currently resolved package without interactive confirmation. 5. Package lifecycle or runtime code executes under the account running the agent. 6. The malicious code can access resources available to that account, subject to operating-system and sandbox restrictions. ### Impact Assessment Successful exploitation provides arb ...[truncated 545 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Replace `mcp-remote@latest` with a reviewed, exact version such as `mcp-remote@x.y.z`. - Pin the package and all transitive dependencies through a lockfile and verify registry integrity hashes. - Avoid `npx -y` for first-time installation. Require explicit approval showing the exact package name and version. - Prefer installing the reviewed package during a controlled build or deployment stage rather than downloading executable code when the Skill is invoked. - Use package provenance or signature verification where available. - Run the MCP client with least privilege in a sandbox or container with restricted filesystem, environment-variable, credential, and network access. - Establish an update process in which new package versions are reviewed and tested before changing the pinned version. ]]>