T08 · Insecure Dependencies
Warning
- Location
- skill.json:30
- Finding
- Automatic Execution of an Unpinned Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `skill.json:30-43`; also documented in `README.md:20-28` **Vulnerability Type**: Unpinned dependency automatically downloaded and executed with access to MCP credentials **Risk Level**: Medium ### Vulnerable Code `skill.json:30-43`: ```json "mcp": { "command": "npx", "args": [ "-y", "@agentdocs1/mcp-server", "--http" ], "env": { "AGENTDOCS_URL": "${config.agentdocs_url}", "API_KEY": "${config.api_key}", "DEFAULT_PACKS": "sales_marketing,customer_success,retail" }, "transport": "http", "url": "${config.agentdocs_url}/mcp" } ``` The corresponding installation configuration appears in `README.md:20-28`: ```json "command": "npx", "args": ["-y", "@agentdocs1/mcp-server", "--http"], "env": { "AGENTDOCS_URL": "https://your-instance.uplo.ai", "API_KEY": "your-api-key", "DEFAULT_PACKS": "sales_marketing,customer_success,retail" } ``` ### Technical Analysis The Skill invokes `npx -y @agentdocs1/mcp-server --http` without specifying an exact package version or integrity hash. When the package is not already available locally, `npx` resolves it through the configured npm registry, downloads it, and executes its entry point. The `-y` option suppresses the normal installation confirmation. Because no version is pinned, the executable code may change after this Skill has been reviewed. A compromised npm publisher account, malicious future release, registry compromise, or package ownership transfer could therefore cause users to execute code that was not present in the audited artifact. The spawned package also receives `API_KEY` and `AGENTDOCS_URL` in its environment. Consequently, malicious package code would be able to read the UPLO MCP credential directly. The package implementation is not included in this project, so its internal behavior and credential handling cannot be verified by this audit. ### Attack Path 1. An attacker compromises the npm account, publicatio ...[truncated 1477 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a reviewed exact version, for example: ```json "args": [ "-y", "@agentdocs1/mcp-server@1.2.3", "--http" ] ``` Do not use version ranges, tags such as `latest`, or an omitted version. 2. Prefer installing dependencies through a committed lockfile and executing the locked local binary rather than allowing `npx` to resolve a package dynamically at every startup. 3. Verify package integrity using npm lockfile integrity metadata, a trusted artifact digest, or a signed release-verification process. 4. Remove `-y` where interactive approval is practical. Although confirmation does not eliminate supply-chain risk, it prevents silent installation of newly resolved packages. 5. Run the MCP server in a sandbox or container with: - A read-only or narrowly scoped filesystem - No access to unrelated user files or environment variables - Restricted outbound network access - A dedicated unprivileged operating-system identity - Resource and process limits 6. Issue a least-privilege API token limited to the required MCP operations, datasets, classification tiers, and tenant. Avoid administrative or broadly reusable credentials. 7. Establish dependency monitoring and release review. Require security validation before changing the pinned package version, and rotate the API key promptly if dependency compromise is suspected. ]]>