T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:24
- Finding
- Unpinned Remote MCP Dependency Exposes Mutable Tools## Vulnerability Details **File Location**: `SKILL.md`, lines 24–29 **Vulnerability Type**: Unpinned third-party MCP service with broad, remotely mutable tool exposure **Risk Level**: Medium ### Vulnerable Code ```markdown ## Connect in 10 Seconds ```bash mcporter config add payram --url https://mcp.payram.com/mcp ``` 36 tools immediately available. No signup. No KYC. ``` The same endpoint is registered again and its remote tools are invoked at lines 73–85: ```bash # 1. Connect PayRam MCP mcporter config add payram --url https://mcp.payram.com/mcp # 2. Test connection mcporter call payram.test_payram_connection # 3. Generate payment snippet for your stack mcporter call payram.generate_payment_sdk_snippet framework=express # 4. Get onboarding guide for autonomous setup mcporter call payram.onboard_agent_setup ``` ### Technical Analysis The Skill instructs users or agents to register a live, externally controlled MCP endpoint and makes 36 remotely defined tools available. The configuration does not pin a reviewed server version, verify a tool manifest, enforce an integrity check, restrict available tools through an allowlist, or define capability boundaries. MCP tool definitions and responses are retrieved from infrastructure outside this project and may change after the Skill has been reviewed. In particular, the remote service is used to generate SDK snippets and autonomous-onboarding instructions. If the service or its delivery infrastructure were compromised or changed, it could return unsafe code, misleading instructions, or unexpected tool definitions that influence subsequent agent behavior. The reviewed project contains only `SKILL.md`; it does not include the MCP server implementation or a fixed manifest for the advertised 36 tools. Consequently, the tools' implementation, permission requirements, data handling, and future behavior cannot be established through this repository's static audit ...[truncated 2001 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the integration to a reviewed, immutable PayRam MCP server release rather than relying solely on a mutable hosted endpoint. 2. Prefer a self-hosted deployment built from a specific source commit and verify release signatures, checksums, or container-image digests. 3. Publish a fixed manifest of required tool names and schemas, then configure an allowlist containing only the tools needed for the documented workflow. 4. Do not automatically execute generated SDK snippets. Present them for human review and apply static analysis, dependency review, and secret scanning before use. 5. Require explicit user confirmation before payment creation, wallet access, fund transfer, approval, signing, or any irreversible financial operation. 6. Run the MCP client with least privilege and isolate it from unrelated credentials, files, environment variables, wallets, and network resources. 7. Document exactly what data each remote tool transmits. Prevent API keys, seed phrases, private keys, wallet credentials, and unrelated user data from being sent. 8. Validate tool responses against strict schemas and reject unexpected tool names, fields, URLs, executable instructions, and capability changes. 9. Monitor and log remote tool discovery and invocation. Alert when the server's tool manifest or schemas differ from the reviewed baseline. 10. Add endpoint identity verification and integrity controls supported by the MCP client, and document a revocation procedure for a compromised service.