T08 · Insecure Dependencies
- Location
llms-install.md:36- Finding
Unpinned Third-Party Packages Are Downloaded and Executed Through npx
- Content
View full analysis
Vulnerability Details
File Location:
llms-install.md:36-42; repeated inDISCOVER.md:72-78andDISCOVER.md:105-108
Vulnerability Type:T08: Insecure Dependencies
Risk Level: MediumVulnerable Code
From
llms-install.md:36-42:bash npx skills add https://github.com/snooptsz/dant3-mcp --skill dant3-networkbash npx skills add snooptsz/dant3-mcpFrom
DISCOVER.md:72-78:bash npx skills add https://github.com/snooptsz/dant3-mcp --skill dant3-networkbash npx skills add snooptsz/dant3-mcpFrom
DISCOVER.md:105-108:json { "mcpServers": { "dant3": { "command": "npx", "args": ["-y", "mcp-remote", "https://dant3.net/mcp"] } } }Technical Analysis
These installation and client configuration examples invoke the
skillsandmcp-remotenpm packages without an exact version or locally verified integrity value. If the packages are absent from the local npm cache,npxresolves and downloads the package available from the configured npm registry at execution time.The
-yoption used formcp-remotealso suppresses the interactive package-installation confirmation. Consequently, the code ultimately executed can change after this Skill has been reviewed. The effective trust boundary therefore includes the npm registry, package maintainers, maintainer accounts, package dependencies, and the user's npm registry configuration.The Skill's anonymous discovery functionality uses a native Streamable HTTP endpoint and does not inherently require local third-party code execution in clients that support that transport. The stdio bridge is documented as a compatibility path, but its unpinned invocation creates avoidable supply-chain exposure.
This finding does not establish that the current packages are malicious. The vulnerability is that mutable, unverified future releases may be executed automatically.
...[truncated 1508 chars]
- Remediation
View remediation
Remediation Suggestions
-
Pin every npm package to a reviewed exact version rather than allowing implicit latest-version resolution, for example:
bash npx --yes skills@REVIEWED_VERSION add https://github.com/snooptsz/dant3-mcp --skill dant3-networkjson { "mcpServers": { "dant3": { "command": "npx", "args": [ "--yes", "mcp-remote@REVIEWED_VERSION", "https://dant3.net/mcp" ] } } } -
Replace
REVIEWED_VERSIONwith an explicitly audited release and update it only through a controlled dependency-review process. -
For reproducible deployments, install dependencies from a committed lockfile using
npm ciand verify registry integrity metadata instead of downloading packages dynamically on each launch. -
Pin the Skill repository reference to a reviewed tag or commit where the installer supports immutable Git references.
-
Prefer native Streamable HTTP configuration whenever the client supports it. Clearly label
mcp-remoteas an optional compatibility bridge rather than a default requirement. -
Document the expected npm publisher, package source repository, and registry. Recommend checking these attributes before first execution.
-
Run any required bridge with a minimal environment and filesystem permissions. Do not expose Human credentials, provider secrets, Dant3 machine credentials, or unrelated environment variables to the bridge process.
-
Apply the same pinned examples consistently in
llms-install.md,DISCOVER.md, and any other documentation containing these commands.
-