T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:9
- Finding
- Unpinned Third-Party npm Executable Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 9–16 **Vulnerability Type**: Unpinned executable dependency and supply-chain exposure **Risk Level**: Medium ```yaml bins: - npx emoji: "🔍" homepage: https://www.brandomica.com install: - kind: node package: brandomica-mcp-server --- ``` ### Technical Analysis The Skill declares `npx` as a required executable and instructs the installation system to obtain `brandomica-mcp-server` without specifying an exact package version, integrity digest, lockfile, or verified artifact. Consequently, the package resolved during installation may differ from the package that existed when the Skill was audited. The repository URL declared in `clawhub.json` provides informational provenance but does not cryptographically bind the installed npm artifact to the reviewed repository source or commit. This creates a supply-chain trust gap. If the npm package, publisher account, release process, or a transitive dependency is compromised, a modified release could introduce arbitrary executable behavior without requiring changes to the audited Skill files. ### Attack Path 1. An attacker compromises the npm publisher account, package release pipeline, or a dependency used by `brandomica-mcp-server`. 2. The attacker publishes a malicious package release under the legitimate package name. 3. A user or Agent installs the Skill after the malicious release becomes the version selected by the package resolver. 4. Because no exact version or integrity value is specified, the installation process accepts the altered artifact. 5. Package installation hooks or subsequent MCP server execution run attacker-controlled JavaScript with the privileges of the user or Agent process. ### Impact Assessment Successful exploitation could permit arbitrary code execution under the account installing or running the MCP server. The attacker could access files, environment variables, credentials, netwo ...[truncated 350 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `brandomica-mcp-server` to an exact reviewed version rather than allowing implicit resolution of the current release. 2. Use a committed lockfile and verify npm integrity hashes for the package and all transitive dependencies. 3. Bind the distributed npm artifact to a reviewed source commit through signed releases, reproducible builds, and package provenance attestations. 4. Disable or carefully review package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. 5. Install and execute the MCP server in a sandbox with minimum filesystem, network, environment-variable, and credential access. 6. Monitor package ownership and release changes, and require a new security review before upgrading the pinned dependency. 7. Where practical, vendor the reviewed implementation or retrieve it from a trusted internal registry with immutable artifacts.