T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:17
- Finding
- Unpinned Third-Party Package Is Automatically Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 17–27 **Vulnerability Type**: Unpinned dependency execution through `npx` **Risk Level**: Medium The documented MCP configuration automatically downloads and executes the latest npm-resolved release of `alltrails-mcp`: ```json { "mcpServers": { "alltrails": { "command": "npx", "args": ["-y", "alltrails-mcp"] } } } ``` ### Technical Analysis The `npx -y alltrails-mcp` command executes a third-party npm package without specifying an exact version, integrity hash, or reviewed lockfile. The `-y` option suppresses the installation confirmation, allowing newly resolved package content to execute automatically whenever the MCP server is installed or launched under applicable `npx` caching and resolution behavior. The reviewed project contains only `SKILL.md`; it does not include the package implementation, a dependency lockfile, integrity metadata, or other controls that would bind execution to an audited artifact. Consequently, the effective executable payload may change after this Skill has been reviewed. This risk is especially relevant because the package is configured as an MCP server and is expected to interact with a browser bridge, an authenticated AllTrails tab, session-derived API capabilities, and private account data. The documentation claims that the server is read-only and retains the captured application key only in memory, but those properties cannot be verified from the files included in this project. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution process, or a future release of `alltrails-mcp`. 2. The attacker publishes a modified package under the same package name. 3. A user applies the documented MCP configuration or subsequently starts it in an environment where `npx` resolves the compromised release. 4. The `-y` option permits installation without an interactive app ...[truncated 1121 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `alltrails-mcp` to an exact, reviewed version rather than allowing npm to resolve the latest release: ```json { "mcpServers": { "alltrails": { "command": "npx", "args": ["--no-install", "alltrails-mcp@<reviewed-exact-version>"] } } } ``` 2. Install the reviewed version separately using a lockfile and verified npm integrity metadata. Use `npx --no-install` or execute a fixed local binary so startup cannot silently download another release. 3. Remove automatic installation approval through `-y` from the runtime configuration. 4. Review the package source, transitive dependencies, publisher provenance, and release artifacts before installation. Re-perform this review before upgrading. 5. Run the MCP server in a sandbox with a minimal filesystem view, a filtered environment, restricted outbound network access, and no access to unrelated credentials. 6. Restrict the browser bridge to the intended AllTrails origin and API operations. Require explicit user approval for pairing and provide a clear method to revoke an existing pairing. 7. Document the exact trusted package version and expected integrity value so users can verify that the installed artifact matches the audited release.