T08 · Insecure Dependencies
Warning
- Location
- skill.json:21
- Finding
- Unpinned Third-Party Package Is Automatically Downloaded and Executed## Vulnerability Details **File Location**: `skill.json:21-26` **Vulnerability Type**: Unpinned and automatically executed third-party dependency **Risk Level**: Medium ### Vulnerable Code ```json "mcp": { "command": "npx", "args": [ "-y", "@agentdocs1/mcp-server", "--http" ], ``` The same unsafe installation pattern is documented in `README.md:20-24`: ```json "command": "npx", "args": ["-y", "@agentdocs1/mcp-server", "--http"], "env": { "AGENTDOCS_URL": "https://your-instance.uplo.ai", "API_KEY": "your-api-key", ``` ### Technical Analysis The configuration invokes `npx` with `-y` and a package name that has no exact version constraint. As a result, the package resolved by the registry at execution time may be downloaded and run automatically without user confirmation. The repository contains no lockfile, integrity hash, vendored implementation, or other mechanism that binds execution to an audited artifact. This creates a supply-chain trust gap: the code that executes when the Skill starts can change after this project has been reviewed. The package namespace, `@agentdocs1`, also differs from the advertised UPLO product identity; the reviewed files do not provide evidence establishing publisher ownership or package provenance. This discrepancy is not itself proof of malicious behavior, but it increases the need for explicit verification. ### Attack Path 1. An attacker compromises the package publisher account, package registry distribution path, or another relevant supply-chain component. 2. The attacker publishes a malicious version of `@agentdocs1/mcp-server`. 3. A user installs or starts the Skill. 4. The Skill executes `npx -y @agentdocs1/mcp-server --http`. 5. `npx` resolves, downloads, and runs the mutable package without an interactive approval step. 6. The malicious package executes with the privileges and environment of the Agent process. 7. It can attempt to read the configured `API_KEY`, access files available to that ...[truncated 793 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the unconstrained package reference with a reviewed, exact version, for example `@agentdocs1/mcp-server@X.Y.Z`; do not use a range or floating tag. 2. Use a lockfile that records package versions and integrity metadata, and enforce reproducible installation with a frozen-lockfile mechanism. 3. Verify the package publisher, source repository, release-signing process, and relationship to UPLO before deployment. 4. Remove automatic acceptance through `npx -y`, or install the dependency through a controlled build and approval process rather than downloading it at runtime. 5. Pin and verify package integrity with registry hashes, signed provenance, or an equivalent artifact-verification mechanism. 6. Run the MCP server in a restricted environment with minimal filesystem access, a narrowly scoped API token, an environment-variable allowlist, and outbound network restrictions. 7. Rotate the MCP token if an untrusted or unverifiable package version has already executed. 8. Add dependency monitoring and require security review before changing the pinned version. 9. Update the installation example in `README.md:20-24` to use the same pinned and verified dependency workflow.