T08 · Insecure Dependencies
- Location
SKILL.md:95- Finding
Unpinned Third-Party Package Execution Through npx
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:95
Vulnerability Type: Supply-chain risk caused by unpinned executable dependencies
Risk Level: MediumComplete Code Snippet:
json { "format": "port-bundle-v1", "agents": [{"name": "search", "command": "npx", "args": ["-y", "search-server"]}], "secrets": {"API_KEY": "{{PLACEHOLDER:API_KEY}}"} }Technical Analysis
The example MCP configuration invokes
npxwith the-yoption and an unversioned package name. If the package is unavailable locally,npxmay retrieve the current package release from the configured registry and execute its installation or runtime code without an interactive confirmation prompt.The configuration does not pin an exact version, verify a package integrity hash, identify a trusted registry, or require approval before execution. As a result, the code ultimately executed can change after the Skill has been reviewed. A compromised package, malicious future release, dependency-confusion package, or registry configuration controlled by an attacker could introduce arbitrary executable code.
Attack Path
- An attacker publishes, takes control of, or compromises the package referenced as
search-server, or influences the package registry used by the victim. - The victim follows the documented migration example and imports the MCP bundle.
- The target Agent or MCP launcher processes the imported command.
- It runs
npx -y search-server. npxretrieves the currently resolved package without interactive confirmation.- Package installation hooks or runtime code execute with the permissions of the user running the Agent.
Impact Assessment
Successful exploitation can provide arbitrary code execution under the Agent user's account. The malicious package could access files and environment variables available to that account, including local MCP credentials, modify user-level configuration, invoke ...[truncated 178 chars]
- An attacker publishes, takes control of, or compromises the package referenced as
- Remediation
View remediation
Remediation Suggestions
- Pin the package to an exact, reviewed version rather than using an unversioned package name.
- Use a lockfile and registry integrity metadata to verify the resolved package contents.
- Document and enforce the expected package registry and package publisher.
- Require explicit user confirmation before installing or executing packages that are not already present locally.
- Validate imported MCP commands against an allowlist of approved executables, packages, versions, and arguments.
- Prefer installing reviewed dependencies in a controlled build step rather than dynamically retrieving them when an imported configuration runs.
- Execute MCP servers with least privilege and restrict their filesystem, environment-variable, and network access.