T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:136
- Finding
- Unpinned Remote Dependencies Can Change and Execute After Review<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:136-142` - `AGENTS.md:58-61` - `AGENTS.md:73-74` - `AGENTS.md:92-93` - `examples/python/requirements.txt:4-16` - `examples/README.md:17` **Vulnerability Type**: Unpinned remote package installation and execution **Risk Level**: Medium ### Complete Code Snippets `SKILL.md:136-142`: ```bash npm install @mapbox/mcp-server ``` Or use directly via npx: ```bash npx @mapbox/mcp-server ``` `AGENTS.md:58-61`: ```bash npm install @mapbox/mcp-server # Or: npx @mapbox/mcp-server export MAPBOX_ACCESS_TOKEN="your_token" ``` `AGENTS.md:70-74`: ```python import subprocess # Start MCP server mcp = subprocess.Popen(['npx', '@mapbox/mcp-server'], env={'MAPBOX_ACCESS_TOKEN': token}) ``` `AGENTS.md:90-93`: ```typescript import { spawn } from 'child_process'; const mcp = spawn('npx', ['@mapbox/mcp-server'], { env: { MAPBOX_ACCESS_TOKEN: process.env.MAPBOX_ACCESS_TOKEN } }); ``` `examples/python/requirements.txt:4-16`: ```text # Core requests>=2.32.0 # Agent Frameworks pydantic-ai>=0.1.0 crewai>=0.83.0 smolagents>=1.0.0 # LLM Providers openai>=1.58.1 # Utilities python-dotenv>=1.0.1 ``` `examples/README.md:17`: ```bash pip install -r requirements.txt ``` ### Technical Analysis The documented `npx @mapbox/mcp-server` command may download and immediately execute the package version selected by the npm registry at invocation time. Because no exact version is specified, the effective executable can change after this Skill has been reviewed. The Python requirements similarly use open-ended lower bounds rather than exact versions or a hash-verified lockfile. A future installation can therefore resolve dependency versions that were not part of this audit. Python and npm package installation can execute package lifecycle or build logic under the installing user's account. The package names observed during the audit are expected public packages, and the TypeScript lockfile resol ...[truncated 1930 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the MCP server to an explicitly reviewed version: ```bash npm install --save-exact @mapbox/mcp-server@REVIEWED_VERSION npx --yes @mapbox/mcp-server@REVIEWED_VERSION ``` 2. Prefer installation from a committed npm lockfile followed by: ```bash npm ci --ignore-scripts ``` If lifecycle scripts are required, review them first and enable scripts only for the necessary installation step. 3. Replace open-ended Python requirements with exact, reviewed versions: ```text requests==REVIEWED_VERSION pydantic-ai==REVIEWED_VERSION crewai==REVIEWED_VERSION smolagents==REVIEWED_VERSION openai==REVIEWED_VERSION python-dotenv==REVIEWED_VERSION ``` 4. Generate and commit a Python lockfile containing hashes. Enforce hash verification during installation, such as with: ```bash pip install --require-hashes -r requirements.lock ``` 5. Use automated dependency scanning and controlled update tooling. Review changelogs, package ownership, provenance, integrity metadata, and lifecycle scripts before accepting upgrades. 6. Run installation and examples in an isolated virtual environment or container under a non-privileged account. Supply narrowly scoped, short-lived API tokens and avoid exposing unrelated credentials to dependency installation processes. 7. Document the exact package versions that were security-reviewed so users do not mistake unconstrained future releases for audited components. ]]>