T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:61
- Finding
- Unpinned Third-Party Packages Are Automatically Executed or Globally Installed## Vulnerability Details **File Location**: `SKILL.md`, lines 61–70, 86–91, and 136 **Vulnerability Type**: Supply-chain exposure through unpinned npm packages **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "hyperbot-quote-mcp": { "command": "npx", "args": ["-y", "mcp-remote", "https://mcp.hyperbot.network/mcp/sse"] } } } ``` ```markdown > **Recommended:** OpenClaw works best with `mcporter` for connecting to remote SSE servers. **Prerequisite:** Install mcporter ```bash npm install -g mcporter ``` ``` ```markdown | "mcp-remote not found" | Run `npm install -g mcp-remote` | ``` ### Technical Analysis The Skill instructs users to run `mcp-remote` through `npx -y` without pinning an exact version. This permits npm to resolve, download, and execute the package version currently selected by the registry. The `-y` option suppresses the normal installation confirmation. The alternative setup and troubleshooting instructions similarly install `mcporter` and `mcp-remote` globally without version constraints, lockfiles, or integrity hashes. Because these packages are not included in the audited project, their installation scripts, transitive dependencies, and runtime behavior cannot be verified from this artifact. The remote MCP connection itself is consistent with the Skill's declared functionality. The security issue is specifically the mutable and automatically executable dependency resolution mechanism. ### Attack Path 1. An attacker compromises the npm account, release process, package registry entry, or a transitive dependency associated with `mcp-remote` or `mcporter`. 2. The attacker publishes a malicious version that contains harmful lifecycle or runtime code. 3. A user follows the documented setup instructions, or the MCP client launches the configured `npx -y mcp-remote` command. 4. npm resolves the unpinned package to the attacker-controlled release and downloads it. 5. The package's installation or ru ...[truncated 953 chars]
- Remediation
- ## Remediation Suggestions 1. Pin each package to an exact, reviewed version, for example: ```json { "command": "npx", "args": [ "--no-install", "mcp-remote", "https://mcp.hyperbot.network/mcp/sse" ] } ``` Install the exact version separately through a project-local dependency declaration: ```bash npm install --save-exact mcp-remote@<reviewed-version> ``` 2. Commit and verify a lockfile so package versions and transitive dependencies are reproducible. 3. Use npm integrity verification, trusted registries, and dependency provenance controls where available. 4. Remove `-y` from `npx` workflows and avoid permitting `npx` to download packages automatically at runtime. 5. Prefer project-local dependencies over global installations. Replace `npm install -g mcporter` and `npm install -g mcp-remote` with exact, locally pinned dependencies. 6. Review package source code, lifecycle scripts, maintainer history, and transitive dependencies before approving a version. 7. Run the MCP bridge with least privilege in an isolated environment that cannot access unrelated credentials or sensitive files. 8. Document the expected package publisher, exact version, checksum or integrity value, and a controlled upgrade process.