T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:27
- Finding
- Unpinned Third-Party Package Is Retrieved and Executed Automatically## Vulnerability Details **File Location**: `SKILL.md`, lines 27-28 **Vulnerability Type**: Unpinned and automatically executed npm dependency **Risk Level**: Medium ```bash npm install -g @presto-ai/google-workspace-mcp mcporter config add google-workspace --command "npx" --arg "-y" --arg "@presto-ai/google-workspace-mcp" --scope home ``` ### Technical Analysis Both commands refer to `@presto-ai/google-workspace-mcp` without pinning an exact version. More importantly, the MCP server configuration invokes the package through `npx -y`. The `-y` option suppresses the installation confirmation, while the absence of a version constraint allows npm to resolve a package release that may differ from the one originally audited. The global installation does not remove this risk because the configured server separately invokes `npx`. The effective executable can therefore change after the Skill has been reviewed. A compromised package release, maintainer account, registry entry, or transitive dependency could introduce arbitrary code that executes with the local user's privileges. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or a transitive dependency and publishes a malicious release. 2. The user follows the Skill instructions or invokes the configured Google Workspace MCP server. 3. `npx -y` resolves and retrieves the unpinned package without requesting interactive installation approval. 4. npm executes the malicious package code with the privileges of the Agent's operating-system user. 5. The payload accesses local files and may target OAuth credentials stored in `~/.config/google-workspace-mcp/`. 6. If valid Google OAuth authorization is available, the compromised server may misuse the exposed Workspace capabilities to read, send, modify, create, download, or delete data where the granted scopes permit it. ### Impact Assessment Successful exploitation permits arbitrary code execution un ...[truncated 665 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the package to a reviewed, exact version in every command, for example: ```bash npm install -g @presto-ai/google-workspace-mcp@X.Y.Z ``` 2. Do not configure the server to retrieve packages dynamically with `npx -y`. Invoke a verified local executable from the pinned installation instead. 3. Use a lockfile and npm integrity metadata where installation architecture permits it. Preserve the reviewed dependency graph rather than resolving newer transitive dependencies automatically. 4. Verify package provenance, publisher identity, release signatures or attestations, and registry integrity before deployment. 5. Review updates in a controlled environment before changing the pinned version. Include source review, dependency-diff analysis, and malware scanning. 6. Restrict Google OAuth scopes to the minimum required operations and use a dedicated account when practical. 7. Protect `~/.config/google-workspace-mcp/` with user-only filesystem permissions and revoke tokens promptly if package compromise is suspected. 8. Run the MCP server in a sandbox or restricted service account with limited filesystem, network, and environment-variable access.