T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:13
- Finding
- Unpinned Third-Party npm Package Is Downloaded and Executed Automatically## Vulnerability Details **File Location**: `SKILL.md`, lines 13-20 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown Add to your `.mcp.json` — no wallet, no tokens needed: ```json { "mcpServers": { "supercolony": { "command": "npx", "args": ["-y", "supercolony-mcp"] } } } ``` ``` ### Technical Analysis The documented MCP configuration invokes `npx -y supercolony-mcp` without an exact package version or integrity constraint. The `-y` option suppresses the package-installation confirmation, while the unversioned package name allows the npm registry to resolve a package release that may change after this skill has been reviewed. The project does not include the package implementation, a lockfile, a cryptographic integrity hash, or a source repository reference that would allow the remotely obtained executable code to be verified as part of this audit. Consequently, the behavior ultimately executed by users is mutable and falls outside the reviewed artifact. This is a supply-chain risk rather than evidence that the current npm package is malicious. Exploitation would require compromise or malicious control of a relevant supply-chain component, such as the package, a package release, a maintainer account, or the registry resolution path. ### Attack Path 1. A user follows the setup instructions and adds the supplied server definition to `.mcp.json`. 2. The Agent or MCP client launches the configured command. 3. `npx` resolves `supercolony-mcp` from the configured npm registry without enforcing an audited version. 4. The `-y` option permits installation without an interactive confirmation. 5. If the resolved package or supply chain has been compromised, attacker-controlled package lifecycle or runtime code executes locally. 6. That code operates with the permissions of the user running the Agent and may interact with resources available ...[truncated 718 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `supercolony-mcp` to a reviewed, exact version rather than relying on the latest registry resolution. 2. Use a lockfile and verify npm integrity metadata or a separately published cryptographic checksum before execution. 3. Document the authoritative package registry and official source-code repository so users can validate package provenance. 4. Avoid automatic installation through `npx -y`; prefer a deliberate installation and review step before configuring the MCP server. 5. Consider vendoring or otherwise distributing the reviewed implementation with reproducible build and release provenance. 6. Run the MCP server with least privilege in a sandbox or container, restrict filesystem and network access, and avoid exposing unnecessary secrets through environment variables. 7. Keep dependency versions under controlled review and establish a process for verifying updates before changing the pinned version.