T08 · Insecure Dependencies
Error
- Location
- SKILL.md:23
- Finding
- Unpinned npm Package Is Downloaded and Executed Without Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:23` and `SKILL.md:31-33` **Vulnerability Type**: Unverified remote dependency execution **Risk Level**: High ### Vulnerable Code At `SKILL.md:23`: ```bash npx autoglm-asr-mcp ``` At `SKILL.md:31-33`: ```json "autoglm-asr": { "command": "npx", "args": ["-y", "autoglm-asr-mcp"], ``` ### Technical Analysis The installation and MCP configuration execute `autoglm-asr-mcp` through `npx` without specifying an exact package version or verifying package integrity. Consequently, the effective executable is resolved from the npm registry at runtime and may change after this skill has been reviewed. The MCP configuration also supplies the `-y` option, which automatically accepts installation prompts. This removes an interactive checkpoint before downloading and executing the remotely resolved package. If the package's publishing account, npm distribution channel, or a future release is compromised, a malicious package version could execute arbitrary lifecycle or application code under the identity of the user running the MCP server. This finding does not establish that the currently published package is malicious. It identifies an unsafe supply-chain execution pattern in which the reviewed skill does not cryptographically or version-wise determine the code that will run. ### Attack Path 1. An attacker compromises the npm account, publishing token, repository release process, or another distribution component associated with `autoglm-asr-mcp`. 2. The attacker publishes a malicious package version under the same package name. 3. A user or agent follows the documented command, or an MCP client starts the configured server. 4. `npx -y autoglm-asr-mcp` resolves and downloads the attacker-controlled version without requesting confirmation. 5. npm lifecycle scripts or the package entry point execute with the permissions and environment of the MCP process ...[truncated 1156 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an exact, reviewed version in every command and MCP configuration, for example: ```bash npx --yes autoglm-asr-mcp@X.Y.Z ``` ```json { "command": "npx", "args": ["--yes", "autoglm-asr-mcp@X.Y.Z"] } ``` 2. Prefer installing through a project manifest and committed lockfile rather than resolving a package dynamically on every launch. Use reproducible installation such as `npm ci`. 3. Verify the package tarball's integrity and provenance before deployment. Record the expected registry, exact version, integrity hash, and reviewed publisher information. 4. Remove automatic confirmation suppression where operationally possible. Require an explicit review step before downloading or updating executable dependencies. 5. Establish a controlled update process in which new versions are reviewed, tested, and approved before changing the pinned version. 6. Run the MCP server in a sandbox, container, or restricted operating-system account. Grant read access only to the audio files required for the current task and deny unnecessary filesystem, process, and network access. 7. Provide the API key through a narrowly scoped secret mechanism. Use a dedicated key with minimal permissions, rotate it regularly, and ensure it is not exposed to unrelated child processes. 8. Consider mirroring the approved package artifact in a trusted internal registry so runtime availability and execution do not depend directly on a mutable public package release. ]]>