T08 · Insecure Dependencies
- Location
SKILL.md:21- Finding
Unpinned Third-Party Package Is Automatically Downloaded and Executed
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 21–23
Vulnerability Type: Unpinned and automatically executed npm dependency
Risk Level: HighVulnerable Code Snippet:
json "gogcli-slides": { "command": "npx", "args": ["-y", "gogcli-mcp-slides"],Technical Analysis
The MCP configuration invokes
npxwith the-yoption and referencesgogcli-mcp-slideswithout an exact version or integrity constraint. Consequently, npm can retrieve and execute the version currently resolved by the configured package registry without asking for user confirmation.Because the resolved artifact is mutable after this Skill has been audited, the code eventually executed is not fully represented by the reviewed project. A compromised package release, npm publisher account, package registry, or transitive dependency could introduce arbitrary executable code. The
-yoption further removes the interactive confirmation that might otherwise alert the user to package installation.There is no evidence in the audited file that the package is currently malicious. The vulnerability is the unsafe dependency acquisition and execution mechanism.
Attack Path
- An attacker compromises the npm package publisher, package distribution channel, or a dependency resolved by
gogcli-mcp-slides. - The attacker publishes a malicious package version that becomes the version selected by the unpinned package reference.
- A user or Agent activates the documented MCP configuration.
npx -y gogcli-mcp-slidesdownloads the mutable package without interactive approval.- npm executes package-controlled installation or runtime code with the privileges of the user running the MCP server.
- The malicious code can access resources available to that process, potentially including local files, environment variables, network connectivity, and the configured Google account authentication context.
Impact Assessm
...[truncated 761 chars]
- An attacker compromises the npm package publisher, package distribution channel, or a dependency resolved by
- Remediation
View remediation
Remediation Suggestions
-
Pin the dependency to a reviewed exact version, for example:
json "args": ["gogcli-mcp-slides@<audited-exact-version>"]Do not use version ranges or floating tags such as
latest. -
Install the dependency through a committed lockfile and use a reproducible installation command such as
npm ci. -
Verify package integrity using the npm lockfile integrity value, a trusted artifact hash, or a signed release verification process.
-
Remove
-ywhere practical so unexpected package installation requires explicit user approval. -
Confirm and document that the npm package publisher and package contents correspond to the referenced source repository.
-
Review the package and its transitive dependencies before approving a version update. Use automated dependency scanning and require manual review for lockfile changes.
-
Run the MCP server in a restricted environment with minimum filesystem access, limited environment variables, constrained outbound network access, and least-privilege Google OAuth scopes.
-
Avoid exposing long-lived Google credentials directly to a dynamically downloaded process. Prefer short-lived credentials and narrowly scoped authorization.
-