T08 · Insecure Dependencies
Error
- Location
- SKILL.md:10
- Finding
- Unpinned npm Package Is Automatically Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 10–16 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ```json "mcp": { "name": "payclaw", "command": "npx", "args": ["-y", "@payclaw/mcp-server"], "env": { "PAYCLAW_API_URL": "https://api.payclaw.io" }, }, ``` ### Technical Analysis The Skill launches `@payclaw/mcp-server` through `npx` without specifying an exact package version or verifying an integrity hash. As a result, the package version resolved at execution time can differ from the version that was originally reviewed. The `-y` option automatically accepts installation prompts, allowing the remotely distributed package to be downloaded and executed without interactive confirmation. Because the MCP server source is not included in the audited project, its effective behavior—including local credential storage, network communication, identity-token processing, and payment-card operations—cannot be verified from this repository. This creates a third-party software supply-chain boundary in which a compromised npm package, publisher account, or subsequently malicious release can introduce arbitrary executable code. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or another component capable of publishing `@payclaw/mcp-server`. 2. The attacker publishes a malicious version under the legitimate package name. 3. A user loads or starts the Skill configuration. 4. `npx -y @payclaw/mcp-server` resolves the unpinned package version and downloads it when necessary. 5. The malicious package executes with the operating-system permissions and environment available to the Agent process. 6. The payload can inspect accessible files and environment variables, intercept PayClaw operations, alter payment requests, misuse locally stored authentication material, or communicate captured data to an attacker-contro ...[truncated 478 chars]
- Remediation
- ## Remediation Suggestions - Pin `@payclaw/mcp-server` to a specific, independently audited version rather than allowing npm to resolve the current release. - Use a lockfile and verify package integrity against an approved cryptographic hash before execution. - Remove automatic confirmation through `-y` where practical, especially for first-time package installation. - Vendor the reviewed MCP server implementation or include its source in the audited artifact so its authentication, credential-storage, networking, and payment behavior can be examined. - Monitor the selected package version for ownership changes, unexpected releases, and dependency-chain compromises. - Run the MCP server in a sandbox with minimal filesystem access, a restricted environment, outbound-network allowlisting, and no access to unrelated credentials. - Apply an explicit upgrade-review process so package versions change only after source and dependency verification.