T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:42
- Finding
- Unpinned npm Bridge Is Automatically Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:42-47` **Additional Location**: `README.md:153-161` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "picsee-short-link": { "command": "npx", "args": ["-y", "mcp-remote", "https://api.picsee.io/mcp"] } } } ``` ### Technical Analysis The recommended configuration invokes `npx` with the `-y` option and references `mcp-remote` without an exact version or integrity constraint. When the MCP client starts this server, npm may download and execute the version currently resolved by the package registry. The effective locally executed code can therefore change after the Skill has been reviewed. Although the bridge is only necessary for clients that do not support Streamable HTTP natively, the instructions do not restrict its use to a reviewed version or require integrity verification. This is a supply-chain weakness rather than evidence that the current `mcp-remote` package is malicious. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or the relevant package distribution channel. 2. The attacker publishes a malicious release under the package name resolved by `npx`. 3. A user installs or starts the MCP configuration recommended by the Skill. 4. `npx -y` retrieves the mutable package version without an interactive confirmation. 5. The malicious package executes under the operating-system identity of the MCP client. 6. The package can access resources available to that process, potentially including local files, environment variables, MCP configuration, and credentials managed or exposed by the client. ### Impact Assessment Successful exploitation could provide arbitrary local code execution with the privileges of the user running the MCP client. The precise scope depends on the host environment and sandboxing, but it may include access to user-readable f ...[truncated 226 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer native MCP Streamable HTTP support and connect directly to `https://api.picsee.io/mcp`. 2. If a stdio bridge is required, pin an exact reviewed version, for example `mcp-remote@<reviewed-version>`. 3. Install the dependency through a lockfile-controlled project rather than downloading it dynamically on each launch. 4. Verify package integrity and provenance before deployment. 5. Disable automatic dependency updates in production configurations. 6. Run the bridge in a restricted environment with minimal filesystem, environment-variable, credential, and network access. 7. Document the reviewed package version and update process in both `SKILL.md` and `README.md`. ]]>