T08 · Insecure Dependencies
Error
- Location
- SKILL.md:132
- Finding
- Unpinned Third-Party MCP Package Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 132-156 **Vulnerability Type**: Unpinned and automatically executed npm dependency **Risk Level**: High ### Vulnerable Code ```json { "mcpServers": { "reddit-insights": { "command": "npx", "args": ["-y", "reddit-insights-mcp"], "env": { "REDDIT_INSIGHTS_API_KEY": "your_api_key_here" } } } } ``` ```json { "mcpServers": { "reddit-insights": { "command": "npx reddit-insights-mcp", "env": { "REDDIT_INSIGHTS_API_KEY": "your_api_key_here" } } } } ``` ### Technical Analysis Both documented configurations execute `reddit-insights-mcp` through `npx` without specifying an exact package version or verifying package integrity. Consequently, the code executed on a user's computer is determined by the package version resolved from the npm registry at execution time rather than by a version reviewed with this Skill. The Claude Desktop configuration also supplies the `-y` option, which automatically accepts package installation and suppresses the normal confirmation prompt. Although this package execution is disclosed as part of setup and there is no evidence that the currently published dependency is malicious, the configuration creates a mutable software supply-chain boundary. A compromised package release, npm publisher account, or package-resolution path could replace the expected MCP implementation with attacker-controlled code. The API key is passed directly into the spawned package's environment. Any executed package version therefore has direct access to `REDDIT_INSIGHTS_API_KEY`. As a local process, it also executes with the permissions of the account running the MCP host. ### Attack Path 1. An attacker compromises the npm publisher account, package publication process, or another relevant package-resolution component for `reddit-insights-mcp`. 2. ...[truncated 1496 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the MCP package to a reviewed exact version, for example: ```json { "command": "npx", "args": ["reddit-insights-mcp@1.2.3"] } ``` 2. Remove `-y` where practical so installation does not occur without user confirmation. 3. Prefer a controlled installation process using a lockfile and npm integrity metadata rather than downloading a package dynamically whenever the server starts. 4. Verify and document the package's official npm publisher, source repository, release signatures, and expected integrity digest. 5. Run the MCP server in a sandbox or dedicated low-privilege account with narrowly scoped filesystem and network access. 6. Use a dedicated, revocable API key with the minimum required permissions and avoid exposing unrelated secrets to the MCP process. 7. Establish a dependency-update review process that examines release changes before advancing the pinned version.