T08 · Insecure Dependencies
- Location
SKILL.md:59- Finding
Unpinned Packages Are Downloaded and Executed Through npx
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:59-65, 98-103, 379-384
Vulnerability Type: Supply-chain exposure caused by mutable, unverified runtime dependencies
Risk Level: MediumComplete Vulnerable Code Snippets
markdown | Fire-ticket query | 12306 MCP Server | `npx -y 12306-mcp` | Verified | ... | Travel guide | Xiaohongshu MCP | `npx -y xhs-mcp` | Optional |The original table labels are written in Chinese, but the executable commands are reproduced unchanged above.
json { "mcpServers": { "12306-mcp": { "command": "npx", "args": ["-y", "12306-mcp"] }, "amap-mcp": { "type": "sse", "url": "https://mcp.amap.com/sse?key={AMAP_WEB_KEY}" } } }The same unpinned configuration is repeated later in the document:
json { "mcpServers": { "12306-mcp": { "command": "npx", "args": ["-y", "12306-mcp"] } } }Technical Analysis
The Skill directs the runtime to invoke
npx -yusing package names without exact versions, lockfile enforcement, integrity hashes, or documented source verification. When the package is not already present in an appropriate cache,npxcan retrieve it from the configured package registry and execute it. The-yoption suppresses the installation confirmation.Consequently, the code ultimately executed is mutable after this Skill has been reviewed. A future package release, compromised maintainer account, registry compromise, malicious ownership transfer, or unsafe registry configuration could cause different code to execute under the same Skill configuration.
This finding concerns dependency integrity. The audit did not establish that either named package is currently malicious.
Attack Path
- An attacker compromises the publisher account, release pipeline, registry entry, or ownership of
12306-mcpor the optionalxhs-mcppackage. - The attacker publishes a malicious release under the expected package name.
- An ...[truncated 1313 chars]
- An attacker compromises the publisher account, release pipeline, registry entry, or ownership of
- Remediation
View remediation
Remediation Suggestions
-
Pin each reviewed dependency to an exact version rather than allowing registry resolution of the latest compatible release:
json { "command": "npx", "args": ["-y", "12306-mcp@REVIEWED_EXACT_VERSION"] } -
Prefer a controlled installation step backed by a committed lockfile and verified integrity metadata instead of downloading dependencies when the Skill is invoked.
-
Verify and document each package's official publisher, source repository, release signatures where available, and expected cryptographic digest.
-
Mirror approved artifacts into a trusted internal registry or artifact repository and restrict package-manager configuration so dependency resolution cannot silently use an untrusted registry.
-
Disable package lifecycle scripts where compatible with the dependency, or inspect all required lifecycle scripts before approval.
-
Execute MCP dependencies inside a restricted sandbox or container with:
- A non-privileged user.
- Read-only access to the project where possible.
- No access to unrelated home-directory files.
- A minimal environment containing only required credentials.
- Network egress limited to required service endpoints.
- Resource and process limits.
-
Apply the same controls to the optional
xhs-mcpintegration before enabling it. -
Add automated dependency monitoring and require security review before updating pinned versions.
-