T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:17
- Finding
- Unpinned Third-Party Code Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 17–36 **Vulnerability Type**: Unpinned executable dependency and mutable remote source **Risk Level**: Medium ### Vulnerable Code ```markdown Add to `.mcp.json` in your project or `~/.claude/mcp.json`: ```json { "mcpServers": { "setlist": { "command": "npx", "args": ["-y", "setlist-mcp"], "env": { "SETLIST_API_KEY": "your-api-key-here" } } } } ``` ### Option B — from source ```bash git clone https://github.com/chrischall/setlist-mcp cd setlist-mcp npm install && npm run build ``` ``` ### Technical Analysis The recommended configuration invokes `npx -y setlist-mcp` without specifying an audited version. The `-y` option suppresses interactive confirmation, allowing npm to download and execute whichever package version currently satisfies the request. Consequently, the code executed later may differ from the code that was reviewed when this Skill was published. The alternative installation method has the same mutability issue: it clones the repository's default branch without pinning a commit or signed release and then executes package lifecycle and build scripts through `npm install && npm run build`. Installation scripts belonging to the package or any transitive dependency can execute with the privileges of the installing user. The referenced npm package and GitHub repository are consistent with the Skill's declared functionality, and the audit found no evidence that either is currently malicious. The vulnerability is the absence of integrity and version controls around remotely retrieved executable code. The MCP process is deliberately provided with `SETLIST_API_KEY`. If an upstream package, repository, maintainer account, or transitive dependency were compromised, downloaded code could read that credential and access any other files, environment variables, and network resources available to the MCP host process. ### Attack Path 1. A ...[truncated 1566 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the npm package to a specifically audited version: ```json { "command": "npx", "args": ["-y", "setlist-mcp@<audited-version>"] } ``` 2. Prefer a locally installed dependency governed by a committed lockfile rather than downloading executable code whenever the MCP server starts. 3. For source installations, check out an audited immutable commit or signed release: ```bash git clone https://github.com/chrischall/setlist-mcp cd setlist-mcp git checkout --detach <audited-commit-sha> npm ci npm run build ``` 4. Verify package provenance, release signatures, and integrity hashes before installation. Review npm lifecycle scripts and the transitive dependency tree. 5. Update dependencies through a controlled review process rather than automatically tracking the latest package or default repository branch. 6. Run the MCP server under a dedicated, least-privileged account or sandbox with access only to required files and network destinations. 7. Supply `SETLIST_API_KEY` through a protected secret-management mechanism where supported. Restrict permissions on `.mcp.json` or `.env` if those files must contain the key. 8. Limit outbound network access to the setlist.fm API and other destinations strictly required for package installation or operation. ]]>