T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:19
- Finding
- Unpinned Third-Party Package Is Downloaded and Executed Automatically## Vulnerability Details **File Location**: `SKILL.md`, lines 19–20 **Vulnerability Type**: Unpinned dependency execution **Risk Level**: Medium ### Vulnerable Code ```json "command": "npx", "args": ["-y", "@vettly/mcp"], ``` ### Technical Analysis The skill directs `npx` to resolve and execute `@vettly/mcp` without specifying an exact package version. The `-y` option suppresses the installation confirmation, allowing the package selected by the registry at execution time to be downloaded and run automatically. Consequently, the code that runs can differ from the version originally reviewed. If the package publisher account, package release process, registry resolution path, or a future release is compromised, attacker-controlled code could execute with the permissions and environment of the MCP process. The process is also configured to receive `VETTLY_API_KEY`, making that credential accessible to the downloaded package. ### Attack Path 1. An attacker compromises the `@vettly/mcp` publishing account, release pipeline, or another relevant supply-chain component. 2. The attacker publishes a malicious version under the expected package name. 3. The documented configuration invokes `npx -y @vettly/mcp` without an exact version. 4. `npx` resolves, downloads, and executes the malicious release without prompting the user. 5. The package reads `VETTLY_API_KEY` from its environment and may perform arbitrary actions permitted to the MCP process, including local data access and outbound network requests. ### Impact Assessment Successful exploitation could expose the configured Vettly API credential and any data available to the MCP process. Because npm packages can execute native Node.js operations, malicious package code could read or alter files accessible to the current user, access inherited environment variables, transmit information externally, or execute child processes. The exact scope is bounded by the operating-system privileges, filesystem access, ...[truncated 167 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an exact, reviewed version, for example: ```json "command": "npx", "args": ["-y", "@vettly/mcp@X.Y.Z"], ``` 2. Prefer installing the package through a committed lockfile and invoking the verified local executable rather than resolving it dynamically on every run. 3. Verify package provenance, publisher identity, release signatures or attestations, and integrity hashes before deployment. 4. Establish an explicit dependency-update process that includes security review and testing before changing the pinned version. 5. Run the MCP server in a sandbox or restricted service account with only the required filesystem and network access. 6. Provide only `VETTLY_API_KEY` to the process, avoid inheriting unrelated secrets, and use a narrowly scoped, revocable API key. 7. Monitor package updates and rotate the API key immediately if supply-chain compromise is suspected.