T08 · Insecure Dependencies
Warning
- Location
- executor.py:216
- Finding
- Unpinned Third-Party Dependencies Permit Supply-Chain Payload Substitution## Vulnerability Details **File Location**: `executor.py:216-241`; additional references in `package.json:5-6` and `SKILL.md:56-57, 197-198, 364` **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Medium ### Vulnerable Code ```python def run_install_deps() -> None: """Install missing dependencies (mcp, futu-stock-mcp-server).""" installed = [] # mcp package if not HAS_MCP: try: subprocess.run([sys.executable, "-m", "pip", "install", "mcp"], check=True, capture_output=True) installed.append("mcp") except subprocess.CalledProcessError as e: print(f"Failed to install mcp: {e}", file=sys.stderr) sys.exit(1) # futu-mcp-server if shutil.which("futu-mcp-server") is None: ok = False if shutil.which("pipx"): try: subprocess.run(["pipx", "install", "futu-stock-mcp-server"], check=True, capture_output=True) installed.append("futu-stock-mcp-server") ok = True except subprocess.CalledProcessError as e: print(f"pipx install failed: {e}", file=sys.stderr) if not ok and shutil.which("pip"): try: subprocess.run([sys.executable, "-m", "pip", "install", "futu-stock-mcp-server"], check=True, capture_output=True) installed.append("futu-stock-mcp-server") ok = True except subprocess.CalledProcessError as e: print(f"pip install failed: {e}", file=sys.stderr) ``` The package setup script contains the same unsafe installation pattern: ```json "scripts": { "setup": "pip install mcp" } ``` ### Technical Analysis Both `mcp` and `futu-stock-mcp-server` are installed without exact version constraints, cryptographic hashes, or a reviewed lockfile. Consequently, the effective code installe ...[truncated 2005 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every dependency to an explicitly reviewed version, for example: ```bash python -m pip install "mcp==REVIEWED_VERSION" pipx install "futu-stock-mcp-server==REVIEWED_VERSION" ``` 2. Maintain a lockfile or requirements file containing cryptographic hashes and install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Pin build-time and transitive dependencies as well as direct dependencies. 4. Replace `package.json`'s unpinned setup command with a controlled installation script that consumes the reviewed lockfile. 5. Avoid automatic dependency installation during normal Skill execution. Fail closed with clear installation instructions when dependencies are absent. 6. Retrieve packages only from an approved package index over TLS, and consider an internal artifact repository containing reviewed artifacts. 7. Run dependency installation and the MCP server in a dedicated, unprivileged virtual environment or isolated service account. 8. Add automated dependency scanning and require security review before updating pinned versions or hashes.