T08 · Insecure Dependencies
Error
- Location
- SKILL.md:32
- Finding
- Unpinned Third-Party MCP Package Is Downloaded and Executed Automatically## Vulnerability Details **File Location**: `SKILL.md`, lines 32-36; duplicated in `references/capabilities.md`, lines 38-42 **Vulnerability Type**: Unpinned and automatically executed third-party dependency **Risk Level**: High ### Vulnerable Code ```markdown ## Dependency - Server name: `aigroup-market-mcp` - Launch pattern: `npx -y aigroup-market-mcp` - Required environment variable: `TUSHARE_TOKEN` ``` The same launch pattern is documented in `references/capabilities.md`: ```markdown ## Dependency - MCP server name: `aigroup-market-mcp` - Local launch pattern in this workspace: `npx -y aigroup-market-mcp` - Required environment variable in this workspace: `TUSHARE_TOKEN` ``` ### Technical Analysis The command `npx -y aigroup-market-mcp` does not specify an exact package version or integrity hash. Depending on the local npm cache and configuration, `npx` can retrieve the current package release from the configured npm registry and immediately execute it. The `-y` option suppresses the installation confirmation prompt. Consequently, the code executed at runtime can differ from the code that was available when this Skill was reviewed. The package is also expected to run in an environment containing `TUSHARE_TOKEN`, giving its executable code access to that credential. The repository does not include the dependency source, a lockfile, an integrity value, or another mechanism that would make the executed artifact reproducible and independently verifiable. The configuration in `agents/openai.yaml` additionally permits implicit invocation: ```yaml policy: allow_implicit_invocation: true ``` This can reduce the degree of explicit user awareness before the external MCP dependency is used, although it does not independently establish malicious behavior. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the package distribution process, or a configured package regis ...[truncated 1425 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to a reviewed exact version, such as `aigroup-market-mcp@X.Y.Z`, rather than resolving the latest available release. 2. Record and verify the package integrity hash through a committed lockfile or equivalent reproducible dependency manifest. 3. Remove `-y` where interactive approval is appropriate, particularly for first-time installation or dependency changes. 4. Prefer a controlled installation step followed by execution from a verified local dependency tree instead of downloading and executing a package during Skill invocation. 5. Verify and document the expected npm publisher, repository, package provenance, and release-signing information. 6. Run the MCP server in a sandbox or container with a read-only filesystem where possible, restricted outbound network access, and no access to unrelated host files. 7. Pass only `TUSHARE_TOKEN` to the process rather than the full parent environment, and ensure that the token has the minimum required permissions and can be rotated promptly. 8. Consider disabling implicit invocation for operations that can start externally sourced executable code, requiring explicit user approval before launch. 9. Add automated dependency monitoring and require security review before updating the pinned version.