T08 · Insecure Dependencies
Error
- Location
- skill.json:24
- Finding
- Unpinned Third-Party npm Package Is Downloaded and Executed Automatically## Vulnerability Details **File Location**: `skill.json:24-31`; installation example repeated in `README.md:17-29` **Vulnerability Type**: Unpinned dependency execution and supply-chain exposure **Risk Level**: High ### Vulnerable Code `skill.json:24-31`: ```json "mcp": { "command": "npx", "args": [ "-y", "@agentdocs1/mcp-server", "--http" ], "env": { ``` The same unsafe installation pattern is documented in `README.md:17-29`: ```json { "mcpServers": { "uplo-construction": { "command": "npx", "args": ["-y", "@agentdocs1/mcp-server", "--http"], "env": { "AGENTDOCS_URL": "https://your-instance.uplo.ai", "API_KEY": "your-api-key", "DEFAULT_PACKS": "construction" } } } } ``` ### Technical Analysis The skill invokes `npx` with the `-y` option and a package name that has no exact version or integrity constraint. Consequently, `npx` can retrieve and execute the package version currently resolved by the npm registry without asking the user for confirmation. This creates a mutable supply-chain execution channel: the code executed during a future installation may differ from the code that existed when the skill was audited. The repository does not contain the MCP server source, a lockfile, a package integrity hash, or another mechanism that permits verification of the downloaded executable. The configured MCP process also receives `API_KEY` and `AGENTDOCS_URL` through its environment. Any code executed through the npm package therefore runs with the local privileges of the user or agent host and may be able to read those inherited credentials. This finding does not establish that the current package is malicious; it identifies the absence of controls preventing a compromised or malicious future release from executing. ### Attack Path 1. An attacker compromises the npm account, package publishing workflow, or r ...[truncated 1691 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an exact audited version, for example `@agentdocs1/mcp-server@X.Y.Z`; do not use a floating tag or version range. 2. Verify the package artifact with a trusted integrity hash or signature and fail closed if verification does not succeed. 3. Maintain and publish a lockfile or equivalent reproducible dependency manifest for the executable MCP server and its transitive dependencies. 4. Remove automatic `-y` acceptance where practical so unexpected downloads require explicit operator approval. 5. Document and independently verify the relationship between the advertised UPLO service and the `@agentdocs1` npm publisher. 6. Prefer a reviewed, immutable package artifact or bundled audited server rather than downloading executable code at startup. 7. Run the MCP server in a sandbox or container with a read-only filesystem, minimal filesystem access, no host administrative privileges, and tightly restricted outbound networking. 8. Issue a dedicated, short-lived API token with only the project and read/write capabilities required by this skill. Do not reuse administrative tokens. 9. Prevent the MCP process from inheriting unrelated secrets and environment variables. 10. Add dependency provenance, signature, vulnerability, and ownership checks to the release process, and update both `skill.json` and the `README.md` example to use the secured invocation.