T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:58
- Finding
- Unpinned npm Package Is Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md:58-60` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash # Start mcp-remote in persistent tmux session tmux -S "$SOCKET" new -d -s spacemolt -n mcp-remote \ "npx -y mcp-remote https://game.spacemolt.com/mcp" ``` The same unpinned execution command appears again at `SKILL.md:239-240`. The installation metadata at `SKILL.md:11-15` also names `mcp-remote` without specifying a version: ```yaml install: - id: mcp-remote kind: node package: mcp-remote bins: ["mcp-remote"] label: "Install mcp-remote (node)" ``` ### Technical Analysis The skill invokes `npx -y mcp-remote` without an exact package version, lockfile, or integrity constraint. If the package is unavailable locally, `npx` can resolve its current release from the configured npm registry, download it, and execute it without an interactive confirmation. Consequently, the effective code executed by the skill can change after the skill itself has been reviewed. A compromised package release, npm account, transitive dependency, or registry configuration could introduce arbitrary code into this execution path. ### Attack Path 1. An attacker compromises the `mcp-remote` publication chain, one of its dependencies, or the npm registry configuration visible to the host. 2. The attacker publishes or causes resolution of a malicious package version. 3. The Agent follows the documented setup or restart procedure. 4. `npx -y` resolves and downloads the mutable package version. 5. The downloaded package executes with the permissions of the user running the Agent. 6. Malicious code can access resources available to that user, including the authenticated MCP process and data exposed in its environment or terminal session. ### Impact Assessment Successful exploitation permits arbitrary local code execution with the ope ...[truncated 377 chars]
- Remediation
- ## Remediation Suggestions - Pin `mcp-remote` to a reviewed, exact version rather than resolving an unconstrained package name. - Use a lockfile with verified integrity hashes and retain it in the reviewed project. - Install dependencies during a controlled setup phase, then invoke the pinned local binary instead of using `npx -y` at runtime. - Configure npm to use a trusted registry and verify package provenance where supported. - Review and update the pinned dependency through an explicit change-control process. - Run the dependency with minimum filesystem, environment, and network access where practical.