T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:16
- Finding
- Unpinned npm Package Is Automatically Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 16-27 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```markdown Add to `.mcp.json` in your project or `~/.claude/mcp.json`: ```json { "mcpServers": { "getyourguide": { "command": "npx", "args": ["-y", "getyourguide-mcp"], "env": { "GYG_API_KEY": "your-partner-api-key" } } } } ``` ``` ### Technical Analysis The documented configuration invokes `npx -y getyourguide-mcp` without an exact package version or integrity constraint. The `-y` option suppresses the installation confirmation, while the absent version causes npm to resolve the package version available from the configured registry at execution time. Consequently, the code executed by this MCP configuration can change after the Skill has been reviewed. The external package and its transitive dependencies are not included in the audited project, so their behavior cannot be verified from this repository. If the package publisher account, npm package, registry resolution, or a transitive dependency is compromised, following these instructions could execute attacker-controlled lifecycle scripts or application code. The MCP process also receives `GYG_API_KEY` through its environment. Any malicious code running in that process can directly read that credential. This is a supply-chain and dependency integrity issue rather than evidence that the currently published package is malicious. The reference to project `.mcp.json` or `~/.claude/mcp.json` is otherwise consistent with the declared setup function. The reviewed document does not instruct the agent to enumerate, read, or exfiltrate unrelated credentials. ### Attack Path 1. An attacker compromises the `getyourguide-mcp` npm publisher account, a transitive dependency, or the relevant package distribution channel. 2. The a ...[truncated 1378 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the MCP package to a specific, reviewed version instead of resolving the latest release dynamically, for example: ```json { "command": "npx", "args": ["-y", "getyourguide-mcp@<audited-exact-version>"] } ``` 2. Prefer installing the dependency through a project manifest and committed lockfile so the package and transitive dependency versions are reproducible. 3. Verify package provenance, publisher identity, release signatures or attestations, and registry integrity before approving upgrades. 4. Review package lifecycle scripts and the corresponding source revision before deployment. Update the pinned version only after security review. 5. Run the MCP server in a sandbox or restricted service account with access only to the files and network destinations required for GetYourGuide API queries. 6. Provide only `GYG_API_KEY` to the process rather than inheriting the agent's complete environment. 7. Store the API key through environment-variable interpolation or a secret manager rather than committing a real credential to project-level `.mcp.json`. 8. Exclude local secret-bearing MCP configuration from version control and rotate the API key if it is accidentally exposed. 9. Restrict outbound network access to the npm registry during controlled installation and to the documented GetYourGuide API endpoint during normal operation where feasible. ]]>