T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:7
- Finding
- Unpinned Globally Installed Third-Party MCP Server## Vulnerability Details **File Location**: `SKILL.md`, lines 7–11 **Vulnerability Type**: Unpinned third-party executable and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```text Prerequisite: install the MCP server package: `npm i -g plati-mcp-server` Configure an MCP server named `plati-scraper` in your local OpenClaw/Claude config: `command: plati-mcp-server` ``` ### Technical Analysis The skill instructs users to install `plati-mcp-server` globally from the npm registry without specifying an exact version, lockfile, integrity hash, verified repository, or publisher identity. Consequently, the package content installed at deployment time can differ from the content reviewed when the skill was published. npm packages may execute lifecycle scripts during installation. After installation, this package is also launched as an MCP server and exposed to the agent as a trusted local tool. Its implementation is not included in the audited project, so its installation-time and runtime behavior cannot be verified from `SKILL.md`. This is a supply-chain weakness rather than evidence that the named package is currently malicious. ### Attack Path 1. An attacker compromises the package publisher, registry account, or package distribution process, or causes users to resolve an unsafe release. 2. The attacker publishes a malicious version under the package name used by the skill. 3. A user follows the unpinned command `npm i -g plati-mcp-server`. 4. npm retrieves the current package version and may run package-controlled lifecycle scripts with the installing user's privileges. 5. The user configures and launches the installed executable as an MCP server. 6. Malicious installation or runtime logic can then act with the user's permissions or return attacker-controlled tool results to the agent. ### Impact Assessment Successful exploitation could execute code with the privileges of the user performing the installation or running the MCP server. ...[truncated 515 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an exact reviewed version, for example `plati-mcp-server@X.Y.Z`, rather than installing the latest release implicitly. 2. Document the package's official publisher, registry location, and source repository so users can verify provenance. 3. Provide and verify an integrity digest for the approved package artifact. 4. Prefer a project-local installation governed by a committed lockfile over a global installation. 5. Review the package source and npm lifecycle scripts before recommending installation. 6. Disable lifecycle scripts during installation with `--ignore-scripts` if they are not required; otherwise, explicitly document and audit every required script. 7. Run the MCP server under a dedicated least-privileged account or sandbox with restricted filesystem, credential, and network access. 8. Define an update-review process so dependency upgrades are audited before the pinned version is changed.