T08 · Insecure Dependencies
Error
- Location
- SKILL.md:46
- Finding
- Unpinned npm Package Executes with Alibaba Cloud Credentials## Vulnerability Details **File Location**: `SKILL.md:46-61`; `references/mcp_server.md:8-25` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: High ### Vulnerable Code `SKILL.md:46-61`: ```bash npm install -g alibabacloud-dataworks-mcp-server ``` ```json { "mcpServers": { "alibabacloud-dataworks-mcp-server": { "command": "npx", "args": ["alibabacloud-dataworks-mcp-server"], "env": { "REGION": "cn-shanghai", "ALIBABA_CLOUD_ACCESS_KEY_ID": "your_access_key_id", "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "your_access_key_secret" } } } } ``` `references/mcp_server.md:8-25` repeats the same unpinned installation and execution pattern: ```bash npm install -g alibabacloud-dataworks-mcp-server ``` ```json { "mcpServers": { "alibabacloud-dataworks-mcp-server": { "command": "npx", "args": ["alibabacloud-dataworks-mcp-server"], "env": { "REGION": "cn-shanghai", "ALIBABA_CLOUD_ACCESS_KEY_ID": "your_access_key_id", "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "your_access_key_secret" } } } } ``` ### Technical Analysis The Skill instructs users to globally install and subsequently execute an npm package without specifying an exact version, lockfile, or package integrity digest. The external package is not included in this repository, so its implementation and security properties cannot be verified as part of this audit. The package is launched with an Alibaba Cloud Access Key ID and Access Key Secret in its process environment. Any code executed by that package can read these values. Because no version is pinned, the effective executable can change after the Skill itself has been reviewed. A compromised maintainer account, npm registry incident, malicious dependency update, or unexpectedly unsafe future release could therefore gain access to the credentials. ...[truncated 1615 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the MCP package to a reviewed, exact version rather than using an unconstrained package name. 2. Use a lockfile and verify npm package integrity hashes in the installation workflow. 3. Avoid combining a global installation with ambiguous `npx` resolution. Execute a verified local dependency using an explicit path. 4. Review the selected release and its transitive dependencies before deployment. 5. Prefer short-lived Alibaba Cloud credentials obtained through RAM roles, STS, workload identity, or another temporary credential mechanism. 6. Assign a dedicated RAM identity with only the DataWorks permissions required for the current operation. 7. Do not place long-lived secrets directly in committed MCP configuration files. 8. Run the MCP server in a restricted environment with controlled network egress, filesystem access, and process permissions. 9. Establish dependency monitoring and require manual approval before package upgrades. 10. Rotate credentials immediately if an executed package version is later found to be compromised.