T03 · Remote Payload Retrieval and Execution
- Location
SKILL.md:19- Finding
Unpinned Third-Party Code Retrieval and Execution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 19-38
Vulnerability Type: Mutable remote dependencies executed without version or commit pinning
Risk Level: HighVulnerable Code
markdown `.mcp.json` (project) or `~/.claude/mcp.json` (global): ```json { "mcpServers": { "redfin": { "command": "npx", "args": ["-y", "redfin-mcp"] } } }2. Install the fetchproxy extension (one-time, shared across all fetchproxy-based MCPs)
bash git clone https://github.com/chrischall/fetchproxy cd fetchproxy npm ci npm --workspace=@fetchproxy/extension-chrome run buildtext ### Technical Analysis The MCP configuration invokes `npx -y redfin-mcp` without specifying an exact package version. Consequently, npm can download and execute whichever version is associated with the package's current distribution tag when the MCP server starts. The `-y` option suppresses the normal installation confirmation, reducing the opportunity for user review. The browser extension installation similarly clones the default branch of a remote Git repository without pinning a reviewed commit or release tag. Its npm lifecycle and build commands then process remotely controlled repository content. The effective code installed by these instructions can therefore change after the Skill itself has been audited. This is a supply-chain weakness rather than evidence that the currently referenced projects are malicious. Exploitation requires compromise or malicious modification of an upstream npm package, Git repository, maintainer account, or publication process. The reference to `.mcp.json` and `~/.claude/mcp.json` is a configuration instruction, not evidence that the Skill reads or extracts credentials. No hardcoded secret or unrelated credential access was identified. However, the configured MCP process executes under the user's account, while the extension is intended to interac ...[truncated 1955 chars]- Remediation
View remediation
Remediation Suggestions
-
Pin
redfin-mcpto an exact reviewed version, for example:json { "mcpServers": { "redfin": { "command": "npx", "args": ["--no-install", "redfin-mcp@<reviewed-exact-version>"] } } }Install the pinned version separately from a trusted registry rather than allowing automatic retrieval whenever the MCP starts.
-
Remove
-yso installation or unexpected retrieval cannot proceed without confirmation. -
Pin the extension repository to a reviewed full commit hash:
bash git clone https://github.com/chrischall/fetchproxy cd fetchproxy git checkout --detach <reviewed-full-commit-hash> npm ci --ignore-scripts npm --workspace=@fetchproxy/extension-chrome run build -
Verify release signatures, package integrity hashes, repository ownership, and the selected commit before installation. Publish known-good hashes in the Skill documentation.
-
Audit npm lifecycle scripts and transitive dependencies before permitting scripts to run. If lifecycle scripts are required, execute them only after review and in a sandboxed build environment.
-
Document and minimize the browser extension's host and API permissions. Restrict access to Redfin domains and only the capabilities necessary to proxy the declared read-only requests.
-
Run the MCP process under a dedicated, minimally privileged account or container without access to unrelated files, credentials, environment variables, or network destinations.
-
Establish an explicit update process in which new package versions and extension commits are reviewed before changing the pinned references.
-