T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:11
- Finding
- Unpinned Third-Party Package Download and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 11–16 **Vulnerability Type**: Unpinned npm dependency executed through `npx` **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "supercolony": { "command": "npx", "args": ["-y", "supercolony-mcp"] } } } ``` ### Technical Analysis The documented configuration runs `npx -y supercolony-mcp` without specifying an exact package version or verifying an integrity digest. Consequently, `npx` may download and execute whichever package release the npm registry currently resolves. The `-y` option automatically accepts installation prompts. The project does not contain the MCP server's source code, a lockfile, or integrity metadata that would allow the executed package to be tied to the version reviewed during this audit. A compromised publisher account, malicious future release, registry compromise, or package-resolution attack could therefore change the effective executable payload after the Skill has been reviewed. ### Attack Path 1. An attacker compromises the npm publisher account, registry distribution path, or a future release of `supercolony-mcp`. 2. The attacker publishes a malicious package version under the resolved package name. 3. A user applies the documented zero-configuration MCP setup. 4. The agent environment invokes `npx -y supercolony-mcp`. 5. `npx` downloads and executes the attacker-controlled release without interactive confirmation. 6. The malicious package operates with the permissions and accessible resources of the user running the agent. ### Impact Assessment Successful exploitation permits arbitrary code execution within the security context of the user who launches the MCP server. Depending on that user's permissions and environment, the package could access readable local files, environment variables, available credentials, MCP request data, and reachable network services. It could also modify files or launch additional processes where the user ha ...[truncated 205 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `supercolony-mcp` to an exact, reviewed version rather than relying on the registry's current resolution. 2. Maintain a lockfile and verify the package and transitive dependencies using trusted integrity hashes. 3. Document and enforce the expected npm registry, package identity, and publisher. 4. Remove automatic installation acceptance with `-y` where interactive review is practical. 5. Prefer vendoring or publishing the MCP server source with the Skill so the executed implementation can be audited. 6. Run the MCP server with least privilege in a sandbox or container that restricts filesystem, environment-variable, process, and network access. 7. Establish an update-review process so dependency upgrades are audited before deployment.