T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:12
- Finding
- Unauditable External Components Receive Authenticated Browser-Session Access## Vulnerability Details **File Location**: `SKILL.md:12-41` **Vulnerability Type**: Third-party supply-chain risk involving a private MCP server and browser extension **Risk Level**: Medium ### Evidence ```markdown - **Source:** [github.com/chrischall/musescore-mcp](https://github.com/chrischall/musescore-mcp) (private) > ⚠️ MuseScore has no public consumer API (the old one was shut down). This > server reads the same server-rendered data the musescore.com web app > hydrates from, dispatched through your own signed-in browser tab via the > fetchproxy extension. Use at your own discretion. ## Setup ### 1. Install musescore-mcp `.mcp.json` (project) or `~/.claude/mcp.json` (global): ```json { "mcpServers": { "musescore": { "command": "node", "args": ["/absolute/path/to/musescore-mcp/dist/bundle.js"] } } } ``` ### 2. Install the fetchproxy extension and sign in Install the [fetchproxy](https://github.com/chrischall/fetchproxy) browser extension and open **musescore.com** signed in, with the Cloudflare check cleared. Every request rides that tab's session. ``` ### Technical Analysis The Skill contains no executable implementation that can be audited. Instead, it directs users to register a Node.js bundle from a private repository as an MCP server and install a separate browser extension. The private source and the exact bundle version, revision, checksum, signature, and extension permissions are not specified. Registering the bundle permits it to execute under the local user's account whenever the MCP server is launched. The browser extension additionally mediates requests through a signed-in MuseScore tab, giving the external components session-backed request capability. Although that access is relevant to the declared MuseScore functionality, it is security-sensitive and broader than unauthenticated metadata retrieval. The reference to `.mcp.json` and `~/.claude/m ...[truncated 1713 chars]
- Remediation
- ## Remediation Suggestions 1. Publish or include the complete MCP server and extension source so their behavior can be independently audited. 2. Pin both components to immutable release versions or commit hashes rather than relying on mutable repository state. 3. Provide cryptographic checksums or signed release artifacts and document a verification procedure. 4. Document the browser extension's complete permission manifest and restrict host permissions to the minimum required MuseScore origins. 5. Enforce an allowlist of permitted request origins, HTTP methods, paths, and content types in the proxy bridge. 6. Prevent forwarding requests to arbitrary origins, loopback services, private-network addresses, or non-MuseScore endpoints. 7. Prefer project-scoped `.mcp.json` configuration over global `~/.claude/mcp.json` registration to reduce cross-project exposure. 8. Run the MCP server with filesystem, network, and process restrictions appropriate to its read-oriented purpose. 9. Clearly describe what authenticated data can be accessed and require explicit user confirmation before session-backed downloads or local PDF writes. 10. Provide reproducible build instructions so users can verify that the distributed bundle corresponds to the reviewed source.