T08 · Insecure Dependencies
Error
- Location
- SKILL.md:21
- Finding
- Unpinned Third-Party Package Is Automatically Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md:17-28` **Vulnerability Type**: Supply-chain exposure through unpinned package execution **Risk Level**: High ### Vulnerable Code ```json { "mcpServers": { "lovtrip": { "command": "npx", "args": ["-y", "lovtrip@latest", "mcp"], "env": { "GEMINI_API_KEY": "your-gemini-api-key" } } } } ``` ### Technical Analysis The recommended MCP configuration invokes `npx` with both `-y` and `lovtrip@latest`. This causes npm to download and execute whichever package version is currently published under that name without interactive confirmation, an exact version constraint, an integrity hash, or a project lockfile. The effective executable can therefore change after this Skill has been reviewed. Although the audited standalone script does not download executable code, following the recommended setup delegates execution to an externally maintained and mutable npm package. This violates least-privilege and reproducibility principles because downloaded package code executes with the invoking user's local permissions and receives the configured `GEMINI_API_KEY` through its environment. ### Attack Path 1. An attacker compromises the npm publisher account, package repository, build pipeline, or a future package release. 2. The attacker publishes a malicious version under the `lovtrip` package name. 3. A user follows the documented MCP configuration. 4. `npx -y lovtrip@latest mcp` retrieves the malicious release and executes it without confirmation. 5. The package reads `GEMINI_API_KEY` from its environment and may access any other files, credentials, network resources, or processes available to the invoking user. 6. The malicious code can exfiltrate data or perform arbitrary actions within that user's privilege boundary. ### Impact Assessment Successful exploitation can provide arbitrary code execution with the privileg ...[truncated 585 chars]
- Remediation
- ## Remediation Suggestions - Replace `lovtrip@latest` with an exact, reviewed version such as `lovtrip@x.y.z`. - Commit a lockfile and enforce package integrity verification where the surrounding installation model supports it. - Avoid `npx -y` for security-sensitive execution because it suppresses confirmation before downloading and running code. - Prefer shipping reviewed implementation code with the Skill or installing dependencies through a controlled build process. - Run the MCP server under a dedicated, restricted account or sandbox with access only to required resources. - Supply only the required API key to the process and prevent inheritance of unrelated secrets. - Establish a dependency update process that reviews source changes, package provenance, and integrity before changing the pinned version.