T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:52
- Finding
- Execution of an Externally Retrieved and Unaudited npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:52-73`, `SKILL.md:80-96`, `SKILL.md:111-122`; `CONNECTORS.md:23-31`, `CONNECTORS.md:54-60`, `CONNECTORS.md:76-88` **Vulnerability Type**: Third-party supply-chain exposure through externally retrieved executable code **Risk Level**: Medium ### Vulnerable Code Segments `SKILL.md:52-73`: ```text - **npm registry fetch** — the recommended connector command `npx -y @usejunior/safe-docx` downloads the package from `registry.npmjs.org` on first run. Subsequent runs use the cached copy unless the cache is cleared. - **No postinstall scripts** — the package declares no `postinstall`, `preinstall`, or `install` hooks. Verify with `npm view @usejunior/safe-docx scripts`. - **Provenance** — releases are published with npm provenance (`--provenance`), so you can verify the package was built from the public GitHub repo via GitHub Actions. - **If you need guaranteed offline install** — pin a specific version and vendor it locally. See the next section. ``` `SKILL.md:80-96`: ```bash # Option 1: Pin a specific version globally npm install -g @usejunior/safe-docx@0.9.0 # Then configure your MCP client to invoke it by path: # command: "safe-docx" # args: [] # Option 2: Vendor the package into your project npm pack @usejunior/safe-docx@0.9.0 # Inspect the tarball, then install it from disk: npm install -g ./usejunior-safe-docx-0.9.0.tgz # Option 3: Build from source (most auditable) git clone https://github.com/UseJunior/safe-docx.git cd safe-docx git checkout <release-tag> npm ci npm run build npm link packages/safe-docx ``` `SKILL.md:111-122`: ```json { "mcpServers": { "safe-docx": { "command": "npx", "args": ["-y", "@usejunior/safe-docx@0.9.0"] } } } ``` `CONNECTORS.md:23-31`: ```json { "mcpServers": { "safe-docx": { "command": "npx", "args": ["-y", "@usejunior/safe-docx@0.9.0"] } } } ``` `CONNECTORS.md:76-88`: ```bash git clone https://github.com/UseJu ...[truncated 3956 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove every unpinned invocation and consistently require an exact reviewed version: ```json { "command": "npx", "args": ["-y", "@usejunior/safe-docx@0.9.0"] } ``` 2. For security-sensitive environments, vendor the exact npm tarball after review and execute a local binary rather than allowing `npx` to retrieve code during invocation. 3. Record and verify a cryptographic digest for the reviewed package artifact. Version pinning alone does not establish artifact integrity. 4. Audit the package source, lockfile, generated distribution files, and complete transitive dependency tree corresponding to the installed artifact. 5. Verify npm provenance and ensure that the published artifact corresponds to the reviewed repository commit and release tag. 6. Use a project-local installation with a locked dependency graph instead of a global npm installation where practical. 7. Run the MCP server in a sandbox with: - Network access denied at the operating-system or container level. - Access restricted to explicitly selected input and output directories. - No access to the entire home directory. - A minimal environment without unrelated secrets or credentials. - A non-privileged operating-system account. 8. Replace the broad `~/` filesystem policy with per-document or dedicated workspace authorization. Enforce path validation outside the third-party process where possible. 9. Align or clearly distinguish the Skill metadata version `0.3.0` and package version `0.9.0` so reviewers can unambiguously identify the audited Skill and executable release. 10. Add automated release checks that reject unpinned package references and verify artifact checksums, provenance, absence of installation hooks, runtime network isolation, and expected filesystem restrictions. ]]>