T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:42
- Finding
- Unpinned Global Installation of a Community npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 42–46 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```markdown Install the MCP server package globally: ```bash npm install -g mistral-mcp ``` ``` The skill metadata also declares the same unpinned dependency at lines 15–19: ```yaml install: - kind: node package: mistral-mcp bins: - mistral-mcp ``` ### Technical Analysis The instructions install the latest available version of the community-maintained `mistral-mcp` package without specifying an exact version or verifying its integrity. Consequently, the code reviewed during the skill audit is not necessarily the code that npm will install later. An npm package can execute lifecycle scripts during installation and exposes the `mistral-mcp` executable that OpenClaw subsequently launches. If a future release or the package publishing account is compromised, following these instructions could install and execute attacker-controlled code. Global installation increases exposure because the executable is placed in a globally accessible npm binary location and may replace or shadow an existing command. This finding does not establish that the current package is malicious. It identifies an unsafe dependency-management pattern that makes the effective payload mutable after review. ### Attack Path 1. An attacker compromises the package publisher account, npm package, or upstream release process. 2. The attacker publishes a malicious version under the existing `mistral-mcp` package name. 3. A user follows the skill instructions and runs `npm install -g mistral-mcp`. 4. npm resolves the unpinned request to the attacker-controlled release. 5. Malicious lifecycle code may execute during installation with the privileges of the user running npm. 6. The globally installed `mistral-mcp` executable is later launched ...[truncated 814 chars]
- Remediation
- ## Remediation Suggestions - Pin the dependency to a reviewed exact version, for example: ```bash npm install -g mistral-mcp@0.3.0 ``` The selected version should match the version actually reviewed; the example must not be adopted without verification. - Record and verify the npm registry integrity digest for the approved package artifact before installation. - Prefer a project-local, lockfile-controlled installation over a global installation. Commit the lockfile and use `npm ci` to obtain reproducible dependency resolution. - Disable npm lifecycle scripts during installation where compatible: ```bash npm install --ignore-scripts --save-exact mistral-mcp@<reviewed-version> ``` - Review the package contents, transitive dependencies, lifecycle scripts, repository provenance, and maintainer history before approving a version. - Run the MCP server as a dedicated, unprivileged account or inside a restricted container with minimal filesystem and network access. - Supply `MISTRAL_API_KEY` only to the required process, use a narrowly scoped credential where supported, and rotate it if dependency compromise is suspected. - Avoid `sudo npm install -g`; document that installation and execution must not use administrative privileges. - Add an explicit upgrade procedure requiring security review before changing the pinned version.