T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:314
- Finding
- Unpinned Third-Party MCP Package Is Executed with Access to a GitHub Token## Vulnerability Details **File Location**: `SKILL.md:314-322` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "github": { "command": "uvx", "args": ["github-mcp"], "env": { "GITHUB_TOKEN": "your_token_here" } } } } ``` ### Technical Analysis The example instructs users to execute `github-mcp` through `uvx` without pinning an exact package version or integrity hash. It also does not identify a canonical package source or verified publisher. Consequently, the package resolved at execution time may differ from the component originally reviewed. The resulting MCP process receives `GITHUB_TOKEN` through its environment. If the package is compromised, substituted, typosquatted, or unexpectedly changed upstream, its initialization code can run with the current user's operating-system privileges and read the token directly from the process environment. This finding concerns the unsafe dependency configuration shown in the documentation. The audit did not establish that the current upstream package itself is malicious. ### Attack Path 1. A user copies the documented MCP configuration into `mcp_config.json`. 2. The user places a valid GitHub token in the `GITHUB_TOKEN` environment entry. 3. Windsurf starts the configured MCP server by invoking `uvx github-mcp`. 4. `uvx` resolves and executes the unpinned package available from its configured package source. 5. If an attacker controls or compromises the resolved package or its dependency chain, malicious initialization code executes locally. 6. The malicious code reads `GITHUB_TOKEN` from its environment and may use or disclose it. 7. The code may also perform local actions permitted to the user who launched Windsurf. ### Impact Assessment Successful exploitation can provide arbitrary code execution with the privileges of ...[truncated 371 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the ambiguous package reference with the canonical package name and document its official publisher and source repository. 2. Pin an audited, exact version instead of resolving the latest available release at runtime. 3. Where supported, lock and verify package hashes or signatures before execution. 4. Use a controlled internal package mirror or an approved dependency allowlist. 5. Run the MCP server in an isolated environment with restricted filesystem and network access. 6. Supply a short-lived, narrowly scoped GitHub token rather than a broadly privileged or personal token. 7. Store the token in an appropriate secret manager and avoid committing a real credential to configuration files. 8. Review the package and its transitive dependencies before upgrades, and monitor for unexpected publisher or ownership changes. 9. Apply the same correction to both `SKILL.md` and its duplicate at `Windsurf/SKILL.md`.