T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:64
- Finding
- Unpinned npm Package Is Downloaded and Executed with Access to an API Key## Vulnerability Details **File Location**: `SKILL.md`, lines 64–73 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ```json { "mcpServers": { "agentwyre": { "command": "npx", "args": ["agentwyre-mcp"], "env": { "AGENTWYRE_API_KEY": "your_key" } } } } ``` ### Technical Analysis The documented MCP configuration invokes `npx agentwyre-mcp` without specifying an exact package version, integrity hash, lockfile, verified publisher, or reviewed source reference. If the package is not already installed locally, `npx` can retrieve it from the npm registry and immediately execute it. Consequently, the code that runs may change after the Skill has been reviewed. The launched package is also explicitly given `AGENTWYRE_API_KEY`. Any malicious or compromised package release—and potentially malicious code in its dependency tree—would execute with the local user's permissions and could read and exfiltrate that credential. This behavior is not required for the core helper script, which uses only Python standard-library modules. It therefore introduces avoidable supply-chain exposure beyond the minimum privileges needed to query the declared API. ### Attack Path 1. An attacker compromises the `agentwyre-mcp` npm package, its publisher account, or a transitive dependency, or causes an unsafe package version to be published. 2. A user adopts the MCP configuration from `SKILL.md`. 3. The MCP client invokes `npx agentwyre-mcp`. 4. `npx` downloads the currently resolved package version when a trusted local copy is unavailable. 5. The downloaded package executes under the user's account and receives `AGENTWYRE_API_KEY` in its environment. 6. Malicious package code can read and exfiltrate the API key, access files available to the user, make network requests, or perform other actions permitted to that process. ### Impact Assessment Successful exploitation could expose the AgentWyre API credential and permi ...[truncated 577 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `agentwyre-mcp` to an explicitly reviewed, immutable version rather than resolving the latest available release. 2. Install the dependency through a committed lockfile and use deterministic installation, such as `npm ci`, instead of allowing `npx` to download code at runtime. 3. Verify package provenance, publisher identity, repository ownership, release signatures or attestations, and registry integrity metadata before installation. 4. Prefer invoking a previously installed and reviewed local binary with automatic package downloading disabled. 5. Review and lock transitive dependencies, and use automated dependency scanning to detect compromised or vulnerable releases. 6. Provide the API key only after package authenticity has been established. Use a narrowly scoped, revocable credential and avoid exposing unrelated environment variables to the process. 7. Run the MCP server in a restricted environment with minimal filesystem and network access where practical. 8. Document the official source repository and approved package checksum or integrity value so users can validate the installed artifact.