T08 · Insecure Dependencies
Error
- Location
- SKILL.md:19
- Finding
- Unpinned npm Package Executes with Resy Account Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 19-32 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```json Add to `.mcp.json` in your project or `~/.claude/mcp.json`: { "mcpServers": { "resy": { "command": "npx", "args": ["-y", "resy-mcp"], "env": { "RESY_EMAIL": "you@example.com", "RESY_PASSWORD": "yourpassword" } } } } ``` ### Technical Analysis The recommended configuration invokes `npx -y resy-mcp` without pinning an exact package version or verifying package integrity. The `-y` option suppresses the interactive installation prompt, allowing npm to download and execute the package automatically. The same process receives `RESY_EMAIL` and `RESY_PASSWORD` through its environment. Consequently, the security of the user's Resy credentials and account operations depends on whichever package version the npm registry resolves at execution time. This creates a mutable supply-chain trust boundary: a compromised maintainer account, malicious new release, or npm registry/package compromise could replace the reviewed behavior after the Skill itself has been audited. The external dependency is necessary to provide the declared MCP functionality, but automatically executing its unpinned latest version with account credentials exceeds the minimum safe dependency privileges. Dependency execution should be reproducible and tied to a reviewed artifact. ### Attack Path 1. An attacker compromises the `resy-mcp` npm package, its publisher account, or a future package release. 2. The attacker publishes a modified version containing credential theft or unauthorized account-operation logic. 3. A user starts the MCP server using the documented `npx -y resy-mcp` configuration. 4. npm resolves, downloads, and executes the attacker-controlled release without an installation confirmation or exact-version constraint. 5. The malicious process reads `RESY_EM ...[truncated 1006 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the floating package reference with an exact, reviewed version, for example: ```json "args": ["-y", "resy-mcp@<reviewed-exact-version>"] ``` 2. Prefer an explicit installation step using a committed lockfile and `npm ci` rather than downloading code whenever the MCP server starts. 3. Verify package provenance, checksums, signatures, publisher identity, and npm provenance attestations before installation. 4. For source-based installation, pin the repository to a reviewed commit instead of cloning and building the mutable default branch. 5. Remove `-y` where feasible so unexpected package installation is not silently approved. 6. Run the server in a sandbox or restricted operating-system account with access only to required network destinations and files. 7. Avoid storing reusable passwords directly in project configuration. Use a protected secret manager or restricted environment injection, and ensure `.mcp.json` and `.env` files are excluded from version control and have restrictive filesystem permissions. 8. Prefer a scoped, revocable Resy token over the account password if the service or implementation later supports one. 9. Monitor and review dependency updates before deployment rather than automatically consuming new releases. ]]>