T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:15
- Finding
- Unpinned Third-Party Package Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:15-38` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```markdown ### Option A — npx (recommended) Add to `.mcp.json` in your project or `~/.claude/mcp.json`: ```json { "mcpServers": { "gemini": { "command": "npx", "args": ["-y", "@chrischall/gemini-mcp"], "env": { "GEMINI_API_KEY": "your-api-key-here" } } } } ``` ### Option B — from source ```bash git clone https://github.com/chrischall/gemini-mcp cd gemini-mcp npm install && npm run build ``` ``` ### Technical Analysis The recommended configuration uses `npx -y` to download and execute `@chrischall/gemini-mcp` without pinning a reviewed package version or verifying package integrity. The `-y` option suppresses the interactive installation prompt, allowing the currently resolved package release to execute automatically. The source-install alternative similarly clones a mutable repository branch without selecting a reviewed commit or release tag, then installs and runs its dependency tree. The instructions do not require lockfile verification, integrity validation, or `npm ci`. The MCP server implementation and dependency lockfile are not included in the audited artifact. Consequently, the runtime behavior of the downloaded package—including its handling of API credentials, local files, clipboard contents, and network requests—cannot be verified from this project. This finding identifies supply-chain exposure; it does not establish that the named package is currently malicious. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, source repository, release process, or a transitive dependency. 2. The attacker publishes malicious code under a version that the unpinned package reference can resolve to, or modifies the repository branch cloned by the documented source-install command. 3. A user follows the ...[truncated 1241 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the npm dependency to a specific, reviewed version: ```json { "command": "npx", "args": ["-y", "@chrischall/gemini-mcp@<reviewed-version>"] } ``` 2. Prefer a locally installed dependency governed by a committed lockfile rather than downloading executable code when the MCP server starts. 3. For source installation: - Check out a reviewed commit SHA rather than a mutable branch. - Verify the repository origin, release signature, or documented checksum. - Commit and review the package lockfile. - Use `npm ci` instead of `npm install` to enforce locked dependency versions. 4. Record expected package and artifact integrity hashes and verify them before execution. 5. Run the MCP server with least privilege: - Restrict filesystem access to required input and output directories. - Prevent access to unrelated credentials and configuration files. - Limit outbound network access to documented Gemini endpoints where practical. - Isolate the process in a container or operating-system sandbox. - Supply a dedicated, narrowly scoped API key with billing limits and rotation procedures. 6. Audit dependency updates before changing the pinned version, including transitive dependency and lifecycle-script changes. ]]>