T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:19
- Finding
- Unpinned Third-Party MCP Server and Browser Extension Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 19–36 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown `.mcp.json` (project) or `~/.claude/mcp.json` (global): ```json { "mcpServers": { "redfin": { "command": "npx", "args": ["-y", "redfin-mcp"] } } } ``` ### 2. Install the fetchproxy extension (one-time, shared across all fetchproxy-based MCPs) ```bash git clone https://github.com/chrischall/fetchproxy cd fetchproxy npm ci npm --workspace=@fetchproxy/extension-chrome run build ``` ``` ### Technical Analysis The configuration invokes `npx -y redfin-mcp` without specifying an exact package version or verifying package integrity. This causes npm to retrieve and execute whichever release is current at installation or invocation time. The effective executable can therefore change after the Skill itself has been reviewed. The browser extension installation is similarly based on a mutable repository default branch. No release tag, commit hash, checksum, or signature is specified before the extension is built and loaded unpacked into Chrome. Although `npm ci` constrains dependencies according to the repository's lockfile at the checked-out revision, it does not protect against the repository revision itself changing or being compromised. These components are particularly sensitive because they operate alongside a signed-in Redfin browser tab and are intended to broker requests using that browser session. A malicious package release, repository revision, or dependency could execute code under the user's local account or abuse access exposed through the browser extension. The reference to `.mcp.json` or `~/.claude/mcp.json` identifies configuration destinations and does not, by itself, demonstrate access to unrelated credentials. Access to Redfin saved homes and searches is aligned with the declared functionality. The confirmed weakness is the absen ...[truncated 1998 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the MCP server to an exact audited version: ```json { "mcpServers": { "redfin": { "command": "npx", "args": ["-y", "redfin-mcp@<audited-exact-version>"] } } } ``` 2. Prefer installing from a locked dependency manifest rather than retrieving an executable package dynamically on every invocation. 3. Pin `fetchproxy` to an audited commit or cryptographically signed release: ```bash git clone https://github.com/chrischall/fetchproxy cd fetchproxy git checkout <audited-commit-hash> ``` 4. Publish expected checksums or signatures for the MCP package, repository revision, built extension, and other distributed artifacts. Verify them before execution or loading. 5. Use reproducible builds and document the exact Node.js, npm, package-lock, MCP package, and extension versions used during security review. 6. Review and document the extension manifest. Restrict host permissions to the minimum Redfin origins required for the declared functionality and avoid access to unrelated websites, cookies, tabs, or browser data. 7. Prefer a signed, versioned extension release over instructing users to load an unpacked build from a mutable source checkout. 8. Run the MCP process with reduced operating-system privileges and limit its filesystem and network access where practical. 9. Establish an update-review process so that new package versions and repository revisions are not adopted automatically before their provenance, dependency changes, and requested permissions are reviewed. ]]>