T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:59
- Finding
- Unpinned Packages Are Downloaded and Executed Through npx## Vulnerability Details **File Location**: `SKILL.md:59-65, 98-103, 379-384` **Vulnerability Type**: Supply-chain exposure caused by mutable, unverified runtime dependencies **Risk Level**: Medium ### Complete Vulnerable Code Snippets ```markdown | Fire-ticket query | 12306 MCP Server | `npx -y 12306-mcp` | Verified | ... | Travel guide | Xiaohongshu MCP | `npx -y xhs-mcp` | Optional | ``` The original table labels are written in Chinese, but the executable commands are reproduced unchanged above. ```json { "mcpServers": { "12306-mcp": { "command": "npx", "args": ["-y", "12306-mcp"] }, "amap-mcp": { "type": "sse", "url": "https://mcp.amap.com/sse?key={AMAP_WEB_KEY}" } } } ``` The same unpinned configuration is repeated later in the document: ```json { "mcpServers": { "12306-mcp": { "command": "npx", "args": ["-y", "12306-mcp"] } } } ``` ### Technical Analysis The Skill directs the runtime to invoke `npx -y` using package names without exact versions, lockfile enforcement, integrity hashes, or documented source verification. When the package is not already present in an appropriate cache, `npx` can retrieve it from the configured package registry and execute it. The `-y` option suppresses the installation confirmation. Consequently, the code ultimately executed is mutable after this Skill has been reviewed. A future package release, compromised maintainer account, registry compromise, malicious ownership transfer, or unsafe registry configuration could cause different code to execute under the same Skill configuration. This finding concerns dependency integrity. The audit did not establish that either named package is currently malicious. ### Attack Path 1. An attacker compromises the publisher account, release pipeline, registry entry, or ownership of `12306-mcp` or the optional `xhs-mcp` package. 2. The attacker publishes a malicious release under the expected package name. 3. An ...[truncated 1313 chars]
- Remediation
- ## Remediation Suggestions 1. Pin each reviewed dependency to an exact version rather than allowing registry resolution of the latest compatible release: ```json { "command": "npx", "args": ["-y", "12306-mcp@REVIEWED_EXACT_VERSION"] } ``` 2. Prefer a controlled installation step backed by a committed lockfile and verified integrity metadata instead of downloading dependencies when the Skill is invoked. 3. Verify and document each package's official publisher, source repository, release signatures where available, and expected cryptographic digest. 4. Mirror approved artifacts into a trusted internal registry or artifact repository and restrict package-manager configuration so dependency resolution cannot silently use an untrusted registry. 5. Disable package lifecycle scripts where compatible with the dependency, or inspect all required lifecycle scripts before approval. 6. Execute MCP dependencies inside a restricted sandbox or container with: - A non-privileged user. - Read-only access to the project where possible. - No access to unrelated home-directory files. - A minimal environment containing only required credentials. - Network egress limited to required service endpoints. - Resource and process limits. 7. Apply the same controls to the optional `xhs-mcp` integration before enabling it. 8. Add automated dependency monitoring and require security review before updating pinned versions.