T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:40
- Finding
- Unpinned Third-Party MCP Package Execution## Vulnerability Details **File Location**: `SKILL.md:40` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown 1. **The MCP server is connected.** These tools appear in your toolset only after the host connects the `scholar-sidekick-mcp` server — Claude Desktop: extension/connector settings; Claude Code: `.mcp.json` or `claude mcp add`; LobeHub: install the matching **MCP plugin**, not just this skill; raw MCP clients: `npx scholar-sidekick-mcp` as the server command. ``` ### Technical Analysis The documented raw-client setup runs `scholar-sidekick-mcp` through `npx` without specifying an exact version or integrity value. Consequently, the package retrieved and executed can change after this skill has been reviewed. The repository contains no dependency lockfile or copy of the MCP server source through which the executed artifact could be verified. This creates a supply-chain risk: if the package, its publishing account, or one of its transitive dependencies is compromised, a future invocation could execute attacker-controlled code. The risk is partially mitigated by the skill's explicit instruction not to install or launch the server silently; exploitation requires an operator to follow the documented external setup guidance. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or a dependency and publishes a malicious release. 2. An operator follows the documented setup command, `npx scholar-sidekick-mcp`, without an exact version. 3. `npx` resolves and executes the currently available package rather than a previously reviewed, immutable release. 4. The malicious package executes with the privileges of the user running the MCP host. 5. It may inspect data and credentials available to that process, including the configured `RAPIDAPI_KEY`, and may perform actions permitted by the host operating-system account. ### ...[truncated 488 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the unversioned command with an exact, reviewed package version, such as `npx scholar-sidekick-mcp@X.Y.Z`. 2. Prefer a locked local installation with a committed lockfile so direct and transitive dependency versions remain reproducible. 3. Publish and verify package integrity hashes, provenance attestations, and release signatures where supported. 4. Review each version before upgrading, and use automated dependency and malware scanning in the release process. 5. Run the MCP server with least privilege in an isolated environment, exposing only the required API key, filesystem paths, and network destinations. 6. Document the server's required environment, filesystem, and network access so operators can apply appropriate sandboxing and secret-management controls.