T08 · Insecure Dependencies
- Location
SKILL.md:44- Finding
Unpinned Third-Party Package Execution via npx
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:44
Vulnerability Type: Supply-chain risk from an unpinned executable dependency
Risk Level: MediumVulnerable Code:
sh npx mcp-remote https://mcp.hekkova.com/mcp --header "Authorization: Bearer $HEKKOVA_API_KEY"Technical Analysis
The documented connection procedure invokes
mcp-remotethroughnpxwithout specifying an exact package version or providing a lockfile and integrity metadata. Depending on the local npm environment,npxmay retrieve and execute the package from the configured registry at invocation time. Consequently, the code ultimately executed can differ from the code that existed when this Skill was audited.The dependency is security-sensitive because it acts as the bridge between the local agent and the remote MCP endpoint. It can process MCP traffic and is launched with a command-line argument containing
HEKKOVA_API_KEY. A malicious or compromised release could inspect the process arguments, read accessible environment variables, intercept user content, modify requests, or execute other commands with the invoking user's privileges.The project contains no local executable scripts, and the audit found no evidence that the Skill author intentionally supplies a malicious package. The vulnerability is the unsafe, mutable dependency-resolution mechanism rather than confirmed malicious behavior.
Attack Path
- An attacker compromises the npm package, a maintainer account, or the package-resolution path used for
mcp-remote. - The attacker publishes or serves a malicious version under the package name.
- A user follows the instruction in
SKILL.md:44. npxresolves, downloads, and executes the unpinned package.- The package reads the bearer credential from its arguments or environment and intercepts content passed through the MCP bridge.
- The package can exfiltrate credentials or content, tamper with MCP oper ...[truncated 1144 chars]
- An attacker compromises the npm package, a maintainer account, or the package-resolution path used for
- Remediation
View remediation
Remediation Suggestions
- Pin
mcp-remoteto a reviewed exact version rather than allowing mutable latest-version resolution:sh npx --yes mcp-remote@<reviewed-exact-version> https://mcp.hekkova.com/mcp --header "Authorization: Bearer $HEKKOVA_API_KEY" - Prefer installing the dependency from a committed lockfile that records package versions and integrity hashes, followed by execution with behavior that prohibits implicit downloads.
- Review the pinned package and its transitive dependency tree before distribution, and use automated dependency monitoring for later security advisories or ownership changes.
- Prefer a reviewed, bundled MCP client where practical so that execution does not depend on mutable registry content at runtime.
- Avoid exposing the API key in command-line arguments where the platform may make process arguments visible. Use a supported environment-based, standard-input, or protected configuration mechanism instead.
- Issue a narrowly scoped API key if Hekkova supports scoped credentials, rotate it periodically, and revoke it immediately if dependency compromise is suspected.
- Run the bridge under a dedicated, non-privileged account or sandbox with restricted filesystem and network access to reduce the impact of a compromised package.
- Pin