T08 · Insecure Dependencies
- Location
SKILL.md:19- Finding
Unpinned Third-Party MCP Server and Browser Extension
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 19-39
Vulnerability Type: Unpinned and automatically executed third-party dependencies
Risk Level: MediumVulnerable Code
markdown `.mcp.json` (project) or `~/.claude/mcp.json` (global): ```json { "mcpServers": { "zillow": { "command": "npx", "args": ["-y", "zillow-mcp"] } } }2. Install the fetchproxy extension (one-time, shared across all fetchproxy-based MCPs)
bash git clone https://github.com/chrischall/fetchproxy cd fetchproxy npm ci npm --workspace=@fetchproxy/extension-chrome run buildThen in Chrome:
chrome://extensions→ Developer mode → Load unpacked → pickpackages/extension-chrome/dist/.text ### Technical Analysis The MCP configuration invokes `npx -y zillow-mcp` without specifying an exact package version or integrity value. The `-y` option automatically accepts package installation, while the absence of a version causes npm to resolve the package available at execution time. The code executed by future users can therefore differ from the version that was originally reviewed. The extension installation similarly clones the mutable default branch of a remote Git repository rather than an immutable, reviewed commit or verified release. The instructions then build that source and load it into Chrome as an unpacked extension. Because the extension routes requests through a signed-in Zillow browser tab, compromise of its source or dependencies could expose authenticated Zillow data within the permissions available to the extension. No evidence establishes that the current npm package or repository is malicious. The vulnerability is the mutable and insufficiently verified supply-chain trust model. The reference to `.mcp.json` and `~/.claude/mcp.json` is configuration guidance, not an instruction to extract credentials. It is therefore not, by itself, a confirmed crede ...[truncated 1682 chars]- Remediation
View remediation
Remediation Suggestions
-
Pin
zillow-mcpto an audited exact version instead of resolving the latest package:json { "mcpServers": { "zillow": { "command": "npx", "args": ["--yes", "zillow-mcp@0.1.0"] } } }Replace the example version with a release that has actually been reviewed.
-
Prefer a lockfile-backed local installation over automatic runtime installation. Verify npm registry integrity metadata and retain the reviewed lockfile.
-
Pin the extension source to an immutable reviewed commit or signed release:
bash git clone https://github.com/chrischall/fetchproxy cd fetchproxy git checkout <reviewed-commit-sha> npm ci npm --workspace=@fetchproxy/extension-chrome run build -
Publish and verify checksums or signatures for the expected package and extension artifacts before execution or loading.
-
Document the extension's required host and browser permissions, and remove any permissions not essential to Zillow request proxying.
-
Advise users to remain signed out for public Zillow queries and authenticate only when invoking saved-home or saved-search functionality. Use a dedicated browser profile to limit exposure of unrelated sessions and browser data.
-
Establish a dependency-review and update process so version changes are explicitly reviewed rather than silently adopted.
-