T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:29
- Finding
- Unpinned Third-Party Dependencies Installed from Public Registries## Vulnerability Details **File Location**: `SKILL.md`, lines 29-30 and 208 **Vulnerability Type**: Supply-chain exposure through unpinned dependencies **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown - **Python path**: Requires `fastmcp` package (`pip install fastmcp`). Optional: `httpx` for HTTP clients, `pytest` for testing. - **TypeScript path**: Requires `@modelcontextprotocol/sdk` and `zod` packages (`npm install`). Optional: `tsx` for development. ``` ```markdown - **Commands suggested**: `pip install fastmcp`, `npm install @modelcontextprotocol/sdk` — these install packages from public registries. Review package names before running. ``` ### Technical Analysis The Skill recommends installing third-party packages without specifying reviewed versions, lockfiles, cryptographic hashes, or registry integrity controls. Commands such as `pip install fastmcp` and `npm install @modelcontextprotocol/sdk` resolve mutable package versions from public registries. Package installation may execute package build hooks or npm lifecycle scripts with the privileges of the user running the package manager. If a direct or transitive dependency is compromised, unexpectedly replaced, or resolves to a malicious release, following the documented instructions could result in local code execution. Installing these dependencies is relevant to the declared MCP server-building functionality. However, using unconstrained versions is not the minimum-risk method of obtaining them. The audit did not identify evidence that the named packages are currently malicious, so this finding concerns unsafe dependency acquisition rather than a confirmed malicious payload. ### Attack Path 1. An attacker compromises a recommended direct dependency, one of its transitive dependencies, or the associated registry publishing account. 2. The attacker publishes a malicious version that satisfies the unconstrained dependency request. 3. A user fol ...[truncated 1089 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every direct dependency to an explicitly reviewed version rather than resolving the latest available release. 2. Provide lockfiles for generated projects, such as `uv.lock`, a hash-locked Python requirements file, or `package-lock.json`. 3. For Python, use hash verification such as `pip install --require-hashes -r requirements.txt`. 4. For npm, use a committed lockfile and recommend `npm ci` for reproducible installation. 5. Document the expected package registry and avoid untrusted mirrors or alternate indexes. 6. Require explicit user approval before running installation commands; do not automatically install dependencies during scaffolding. 7. Recommend installation inside a dedicated virtual environment, container, or other non-privileged development sandbox. 8. Add dependency vulnerability and provenance checks, such as `pip-audit`, `npm audit`, registry signature verification where available, and periodic review of pinned versions. 9. Warn users not to execute package-manager commands as root or an administrator.