T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:132
- Finding
- Automatic Execution of an External npm Package Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md`, lines 132-180 **Vulnerability Type**: Third-party dependency and supply-chain risk **Risk Level**: Medium ### Vulnerable Code ```markdown Use `npx` when the MCP client runs local stdio servers. #### Claude Desktop Edit: ```text ~/Library/Application Support/Claude/claude_desktop_config.json ``` Add: ```json { "mcpServers": { "coinversaa": { "command": "npx", "args": ["-y", "@coinversaa/mcp-server@0.7.0"], "env": { "COINVERSAA_API_KEY": "cvsa_your_key_here" } } } } ``` #### Cursor Add to `.cursor/mcp.json`: ```json { "mcpServers": { "coinversaa": { "command": "npx", "args": ["-y", "@coinversaa/mcp-server@0.7.0"], "env": { "COINVERSAA_API_KEY": "cvsa_your_key_here" } } } } ``` #### Claude Code ```bash claude mcp add coinversaa -- npx -y @coinversaa/mcp-server@0.7.0 export COINVERSAA_API_KEY="cvsa_your_key_here" ``` ``` ### Technical Analysis The installation instructions cause MCP clients to download and execute the external npm package `@coinversaa/mcp-server` through `npx`. The `-y` option suppresses interactive confirmation. Although version `0.7.0` is pinned, the instructions do not verify the package artifact against a cryptographic digest, vendor the executable source, or provide a reproducible-build verification process. The audited project contains only `SKILL.md`; the npm package implementation is not included. Consequently, the code that receives the API key and runs with the local user's permissions cannot be inspected or verified as part of this audit. This is a supply-chain exposure rather than evidence that the current published package is malicious. If the npm package, publisher account, registry distribution path, or referenced release artifact were compromised, package lifecycle or runtime co ...[truncated 1605 chars]
- Remediation
- ## Remediation Suggestions 1. Vendor the reviewed MCP server implementation with the skill, or provide a transparent, auditable source mapping for the exact published artifact. 2. Publish cryptographic checksums or signed provenance for release artifacts and document a verification procedure before execution. 3. Use npm provenance, signed releases, protected publisher accounts, mandatory multi-factor authentication, and tightly restricted publishing tokens. 4. Prefer a lockfile-based installation workflow with integrity metadata over downloading and executing the package dynamically whenever the MCP client starts. 5. Avoid `npx -y` for first-time installation. Require an explicit review and installation step before configuring the MCP client to run the package. 6. Run the MCP server under a dedicated, least-privileged operating-system account or sandbox with restricted filesystem and network access. 7. Supply a dedicated Coinversa API key with the minimum required tier and permissions. Rotate it immediately if package or host compromise is suspected. 8. Document how users can inspect the installed package, verify its version and digest, review exposed MCP tools, and remove the server safely.