T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:19
- Finding
- Unpinned Third-Party Package and Browser Extension Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 19-39 **Vulnerability Type**: Supply-chain exposure through mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown `.mcp.json` (project) or `~/.claude/mcp.json` (global): ```json { "mcpServers": { "compass": { "command": "npx", "args": ["-y", "compass-mcp"] } } } ``` ### 2. Install the fetchproxy extension (one-time, shared across all fetchproxy-based MCPs) ```bash git clone https://github.com/chrischall/fetchproxy cd fetchproxy npm ci npm --workspace=@fetchproxy/extension-chrome run build ``` ``` ### Technical Analysis The MCP configuration invokes `npx -y compass-mcp` without specifying an audited package version or integrity value. Consequently, each fresh installation may download and execute whichever version the package registry currently resolves. The `-y` option suppresses the interactive installation confirmation. The browser extension installation similarly clones the repository's current default branch without pinning an audited tag or commit. Although `npm ci` provides deterministic dependency installation when a valid lockfile is present, it does not ensure that the cloned repository or its lockfile is the same version that was previously reviewed. This is particularly sensitive because the documented architecture routes requests through a signed-in Compass browser tab. A malicious or compromised future package, repository revision, maintainer account, or transitive dependency could execute during installation, MCP startup, extension build, or extension operation. The precise Chrome permissions are not included in the audited file, so access beyond the documented browser bridge cannot be confirmed from this audit. The reference to `.mcp.json` and `~/.claude/mcp.json` is configuration guidance rather than evidence that the skill reads credentials. No credenti ...[truncated 1743 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the MCP package to a specifically reviewed version, for example: ```json { "mcpServers": { "compass": { "command": "npx", "args": ["-y", "compass-mcp@<audited-version>"] } } } ``` 2. Record and verify the package integrity digest. Where practical, install from a controlled lockfile or an internally reviewed artifact rather than resolving the package dynamically at every launch. 3. Pin the extension source to an audited commit: ```bash git clone https://github.com/chrischall/fetchproxy cd fetchproxy git checkout <audited-commit-sha> ``` 4. Verify the checked-out commit against an expected SHA and, where available, require signed tags or verified commits. 5. Audit the repository lockfile and transitive dependencies before running `npm ci`. Consider disabling dependency lifecycle scripts during installation unless they are explicitly required and reviewed. 6. Build the extension in an isolated, low-privilege environment and distribute a verified artifact with a documented checksum. 7. Document and minimize all Chrome extension permissions, restricting host access to the exact Compass and local bridge origins required. 8. Prefer project-scoped `.mcp.json` configuration over global `~/.claude/mcp.json` unless global availability is explicitly necessary. 9. Run the MCP under a dedicated low-privilege account or sandbox with restricted filesystem, environment-variable, and outbound-network access.