T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:44
- Finding
- Unpinned Third-Party Package Execution via npx## Vulnerability Details **File Location**: `SKILL.md:44` **Vulnerability Type**: Supply-chain risk from an unpinned executable dependency **Risk Level**: Medium **Vulnerable Code**: ```sh npx mcp-remote https://mcp.hekkova.com/mcp --header "Authorization: Bearer $HEKKOVA_API_KEY" ``` ### Technical Analysis The documented connection procedure invokes `mcp-remote` through `npx` without specifying an exact package version or providing a lockfile and integrity metadata. Depending on the local npm environment, `npx` may retrieve and execute the package from the configured registry at invocation time. Consequently, the code ultimately executed can differ from the code that existed when this Skill was audited. The dependency is security-sensitive because it acts as the bridge between the local agent and the remote MCP endpoint. It can process MCP traffic and is launched with a command-line argument containing `HEKKOVA_API_KEY`. A malicious or compromised release could inspect the process arguments, read accessible environment variables, intercept user content, modify requests, or execute other commands with the invoking user's privileges. The project contains no local executable scripts, and the audit found no evidence that the Skill author intentionally supplies a malicious package. The vulnerability is the unsafe, mutable dependency-resolution mechanism rather than confirmed malicious behavior. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or the package-resolution path used for `mcp-remote`. 2. The attacker publishes or serves a malicious version under the package name. 3. A user follows the instruction in `SKILL.md:44`. 4. `npx` resolves, downloads, and executes the unpinned package. 5. The package reads the bearer credential from its arguments or environment and intercepts content passed through the MCP bridge. 6. The package can exfiltrate credentials or content, tamper with MCP oper ...[truncated 1144 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `mcp-remote` to a reviewed exact version rather than allowing mutable latest-version resolution: ```sh npx --yes mcp-remote@<reviewed-exact-version> https://mcp.hekkova.com/mcp --header "Authorization: Bearer $HEKKOVA_API_KEY" ``` 2. Prefer installing the dependency from a committed lockfile that records package versions and integrity hashes, followed by execution with behavior that prohibits implicit downloads. 3. Review the pinned package and its transitive dependency tree before distribution, and use automated dependency monitoring for later security advisories or ownership changes. 4. Prefer a reviewed, bundled MCP client where practical so that execution does not depend on mutable registry content at runtime. 5. Avoid exposing the API key in command-line arguments where the platform may make process arguments visible. Use a supported environment-based, standard-input, or protected configuration mechanism instead. 6. Issue a narrowly scoped API key if Hekkova supports scoped credentials, rotate it periodically, and revoke it immediately if dependency compromise is suspected. 7. Run the bridge under a dedicated, non-privileged account or sandbox with restricted filesystem and network access to reduce the impact of a compromised package.