T03 · Remote Payload Retrieval and Execution
Error
- Location
- config/mcporter.json:4
- Finding
- Unpinned Remote GitHub Package Is Automatically Downloaded and Executed with Banking Credentials<![CDATA[ ## Vulnerability Details **File Location**: `config/mcporter.json:4-8`; `SKILL.md:42-44` **Vulnerability Type**: Remote payload execution through an unpinned third-party dependency **Risk Level**: High ### Vulnerable Code `config/mcporter.json:4-8`: ```json "command": "npx", "args": ["-y", "github:Maay/brighty_mcp"], "env": { "BRIGHTY_API_KEY": "${BRIGHTY_API_KEY}" } ``` `SKILL.md:42-44`: ```bash mcporter config add brighty --command "npx -y github:Maay/brighty_mcp" --env BRIGHTY_API_KEY=your-api-key ``` ### Technical Analysis The configuration invokes `npx -y` against the mutable GitHub reference `github:Maay/brighty_mcp`. No immutable commit SHA, verified release version, checksum, or lockfile is specified. The `-y` option permits installation without interactive approval. Consequently, the code executed at runtime can differ from the code that was reviewed. A compromised upstream repository, malicious maintainer update, or repository ownership change could introduce arbitrary code that is automatically downloaded and executed when the MCP server starts. The process explicitly receives `BRIGHTY_API_KEY` through its environment. This key supports a banking interface that exposes account, card, transfer, payout, and team-management operations. The combination of mutable remote code and a high-value credential substantially increases the consequence of a supply-chain compromise. The reference to `~/.openclaw/.env` in `SKILL.md:38` is only setup guidance; no project code directly reads or enumerates that path. Environment-based credential injection is necessary for the declared integration. The security concern is that the credential is passed to unpinned remotely retrieved code. ### Attack Path 1. An attacker compromises the `Maay/brighty_mcp` GitHub repository, gains maintainer access, or causes its referenced default branch to contain malicious code. 2. A user invokes the configured Brighty MCP server. 3. `npx -y github:Maay/brighty_mcp` ...[truncated 1623 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Pin the dependency to an immutable revision** - Replace the mutable GitHub reference with a reviewed commit SHA or a cryptographically verified, immutable release. - Do not depend on a branch name, default branch, or moving tag. 2. **Verify package integrity** - Prefer a published package with a lockfile and integrity hash. - Validate release signatures or checksums before execution. - Establish a controlled process for reviewing and approving dependency updates. 3. **Avoid automatic installation** - Remove `-y` so unexpected downloads require explicit approval. - Preinstall the reviewed server artifact in a controlled environment rather than retrieving it whenever the Skill starts. 4. **Apply credential least privilege** - Use a dedicated, revocable API token with only the permissions required for the intended workflow. - Separate read-only and transaction-capable credentials where Brighty supports this. - Rotate the key after suspected dependency compromise and monitor its usage. 5. **Isolate the MCP server** - Run it in a sandbox or container with restricted filesystem access, a minimal environment, and outbound network access limited to required Brighty endpoints. - Do not expose unrelated environment variables or user credentials to the process. - Run it as an unprivileged user. 6. **Retain transaction safeguards** - Enforce confirmation outside the remotely supplied MCP server before payouts, account termination, or other irreversible operations. - Display and validate recipients, currencies, amounts, fees, and source accounts before authorization. - Use server-side transaction limits and audit logging so safety does not depend solely on instructions in `SKILL.md`. ]]>