T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:20
- Finding
- Unpinned Third-Party MCP Package Is Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md:20-26` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "remarkable": { "command": "uvx", "args": ["remarkable-mcp", "--usb"] } } } ``` The same unpinned `remarkable-mcp` package is also invoked by the SSH, cloud, and OCR configurations at `SKILL.md:34-40`, `SKILL.md:45-54`, and `SKILL.md:60-69`. ### Technical Analysis The configuration directs `uvx` to resolve and execute `remarkable-mcp` without specifying a reviewed package version, cryptographic hash, signature, or verified source. Consequently, the code ultimately executed may change after this Skill has been reviewed. The dependency is security-sensitive because its intended role gives it access to private tablet documents. Depending on the selected configuration, it may also receive SSH access, a reMarkable cloud token, or a Google Vision API key. The project contains no implementation of `remarkable-mcp`, so the external package's behavior could not be audited from the supplied artifact. This is a supply-chain exposure rather than evidence that the current package is malicious. ### Attack Path 1. An attacker compromises the `remarkable-mcp` package, its publisher account, or the package distribution channel. 2. The attacker publishes a malicious version under the package name resolved by `uvx`. 3. A user starts the MCP server using the documented configuration. 4. `uvx` resolves and executes the uncontrolled package version. 5. The malicious package runs with the permissions of the MCP process and can attempt to access tablet content, process-visible credentials, available network resources, and any other resources exposed to that process. ### Impact Assessment Successful exploitation could expose private documents and credentials supplied to the MCP server, including a reMarkab ...[truncated 482 chars]
- Remediation
- ## Remediation Suggestions - Pin `remarkable-mcp` to a specifically reviewed version rather than resolving the latest available release. - Use a trusted package registry and explicitly document the package's official publisher and source repository. - Enforce integrity verification through hashes, signed artifacts, or a locked dependency manifest where supported. - Review each dependency update before changing the pinned version. - Run the MCP server in a sandbox with minimal filesystem, network, USB-device, and process access. - Supply only the credentials required for the selected mode, scope them narrowly, and rotate them if package compromise is suspected. - Avoid exposing unrelated environment variables or host credentials to the MCP process. - Apply equivalent pinning and isolation to the USB, SSH, cloud, and OCR configurations.