T08 · Insecure Dependencies
Warning
- Location
scripts/glm-search.sh:122- Finding
Unpinned mcporter Package Is Downloaded and Executed at Runtime
- Content
View full analysis
/dev/null && ! command -v npx &>/dev/null; then echo "Error: mcporter/npx not found." >&2 echo "Install: npm i -g mcporter" >&2 return 1 fi local extra_args=() [ -n "$DOMAIN" ] && extra_args+=("search_domain_filter=$DOMAIN") exec npx -y mcporter --config "$MCP_CONFIG" call "glm-search.${MCP_TOOL}" \ search_query="$QUERY" \ count="$COUNT" \ search_recency_filter="$RECENCY" \ content_size="$CONTENT_SIZE" \ "${extra_args[@]+"${extra_args[@]}"}" ``` The same unsafe package invocation also occurs during MCP verification in `scripts/setup.sh:71`: ```bash RESULT=$(npx -y mcporter --config "$MCP_CONFIG" list glm-search 2>&1) || true ``` ### Technical Analysis The scripts invoke `npx -y mcporter` without specifying a reviewed package version or verifying package integrity. When the package is not already present in the relevant npm cache, `npx` can retrieve the current package release from the configured npm registry and execute it immediately. The `-y` option suppresses the installation confirmation. Consequently, the code executed by the Skill can change after the Skill itself has been reviewed. Compromise of the package, its maintainer account, a transitive dependency, or the configured npm registry could result in arbitrary code execution. The risk is increased because `mcporter` is given access to `mcporter.json`. In MCP mode, that file contains the Zhipu API key in the broker URL. Although the script checks whether a globally installed `mcporter` executable exists, it still invokes `npx`, rather than explicitly invoking that installed executable. ### Attack Path 1. An attacker compromises the `mcporter` package, one of its dependencies, its publishing acco ...[truncated 1247 chars]- Remediation
View remediation
... ``` 2. Prefer declaring the dependency in a package manifest and committing a lockfile with integrity hashes. 3. Install dependencies in a controlled setup phase using `npm ci`, then invoke the pinned local executable: ```bash ./node_modules/.bin/mcporter --config "$MCP_CONFIG" ... ``` 4. Do not download executable dependencies during ordinary search operations. 5. Use a trusted registry and incorporate package provenance, signature, and integrity validation into the release process. 6. Run the dependency with the minimum filesystem and environment access necessary. Avoid exposing unrelated credentials to its process. 7. If a reviewed global `mcporter` installation is supported, invoke `mcporter` directly rather than checking for it and then executing `npx`. ]]>