T08 · Insecure Dependencies
Error
- Location
- skill.json:26
- Finding
- Unpinned npm Package Is Automatically Executed with Access to the MCP API Key## Vulnerability Details **File Location**: `skill.json:26-36`; duplicated in installation guidance at `README.md:21-26` **Vulnerability Type**: Unpinned third-party dependency execution with secret access **Risk Level**: High ### Vulnerable Code `skill.json:26-36`: ```json "command": "npx", "args": [ "-y", "@agentdocs1/mcp-server", "--http" ], "env": { "AGENTDOCS_URL": "${config.agentdocs_url}", "API_KEY": "${config.api_key}", "DEFAULT_PACKS": "legal,finance,government" }, ``` The same unsafe execution pattern is documented in `README.md:21-26`: ```json "command": "npx", "args": ["-y", "@agentdocs1/mcp-server", "--http"], "env": { "AGENTDOCS_URL": "https://your-instance.uplo.ai", "API_KEY": "your-api-key", "DEFAULT_PACKS": "legal,finance,government" } ``` ### Technical Analysis The Skill invokes `npx -y @agentdocs1/mcp-server --http` without specifying an exact package version or validating package integrity. Depending on the local npm cache and environment, `npx` can retrieve the current package release from the configured npm registry and execute it immediately. The `-y` option suppresses the interactive installation confirmation. The executed package inherits the configured environment, including `API_KEY` and `AGENTDOCS_URL`. Consequently, the security of the API credential and connected compliance data depends on every package version subsequently resolved under this unpinned package name. If the package, its publisher account, one of its transitive dependencies, or the configured registry is compromised, attacker-controlled code could execute during Skill startup. There is no evidence that the current package is malicious; the vulnerability is the lack of deterministic dependency pinning and integrity enforcement while granting the dependency access to a secret. ### Attack Path 1. An attacker compromises the `@agentdocs1/mcp-server` publisher account, package ...[truncated 1466 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to a reviewed exact version, for example: ```json "args": [ "-y", "@agentdocs1/mcp-server@1.2.3", "--http" ] ``` Replace the example version with a release that has been independently reviewed and approved. 2. Avoid downloading packages during Skill startup. Install dependencies during a controlled build or deployment phase and execute the verified local binary. 3. Commit and enforce a lockfile with integrity hashes. Use deterministic installation such as `npm ci` from a trusted registry. 4. Verify package provenance, signatures, ownership, and release integrity before upgrades. Introduce dependency review and automated supply-chain scanning into the release process. 5. Replace long-lived API keys with short-lived, revocable credentials. Scope the token to only the MCP tools, data classifications, and organizational domains required by this Skill. 6. Run the MCP package in a sandbox or isolated container with restricted filesystem access, minimal operating-system privileges, and outbound network access limited to the approved UPLO endpoint. 7. Remove `-y` where runtime installation remains unavoidable so unexpected installation or resolution changes are not silently accepted. 8. Update the `README.md` configuration example to use the same pinned and hardened execution method, preventing users from copying the insecure configuration. 9. Rotate the API key promptly if an untrusted package version has previously been executed, and review MCP access logs for unexpected queries, exports, updates, or connections.