T08 · Insecure Dependencies
Warning
- Location
scripts/requirements.txt:1- Finding
Unpinned Dependencies Permit Unreviewed Package Installation and Execution
- Content
View full analysis
=0.39.0 mcp>=1.1.0 ``` `SKILL.md:140-141`: ```markdown - Run `npm run build` to verify compilation - Test with MCP Inspector: `npx @modelcontextprotocol/inspector` ``` `reference/evaluation.md:384-392`: ```bash pip install -r scripts/requirements.txt ``` ```bash pip install anthropic mcp ``` ### Technical Analysis The Python dependency manifest specifies only minimum versions. It therefore permits installation of any newer release available at resolution time. The alternative installation command does not specify versions at all. The documented `npx @modelcontextprotocol/inspector` command may download and immediately execute the package version selected by the registry and local `npx` behavior. No exact version, lock file, integrity value, or reviewed local installation is required. Consequently, the code users execute is not necessarily the code that was available during the Skill's audit. This makes installations non-reproducible and unnecessarily expands trust to all future releases of the named packages and their transitive dependencies. ### Attack Path 1. An upstream package, maintainer account, release process, or transitive dependency is compromised. 2. A malicious or otherwise unsafe package version is published with a version satisfying the open-ended constraint. 3. A user follows the documented `pip install` or `npx` command. 4. The package manager resolves and downloads the new, unaudited release. 5. Package installation hooks or the package executable run with the user's current operating-system privileges. 6. The compromised package can access files, environment variables, credentials, and network resources av ...[truncated 535 chars]- Remediation
View remediation
mcp== ``` 2. Generate a fully locked dependency set, including transitive dependencies, using a tool such as `pip-compile`, Poetry, or uv. 3. Require package hashes during installation: ```bash pip install --require-hashes -r requirements.lock ``` 4. Add a package lock file for Node-based tools and install with a reproducible command such as `npm ci`. 5. Install MCP Inspector as a pinned local development dependency and invoke it without permitting an implicit latest-version download: ```bash npm install --save-dev --save-exact @modelcontextprotocol/inspector@ npx --no-install @modelcontextprotocol/inspector ``` 6. Enable dependency scanning and update dependencies through reviewed pull requests rather than resolving arbitrary future versions during normal execution. 7. Run package installation and evaluation in an isolated environment without production credentials or unnecessary filesystem access. ]]>