T08 · Insecure Dependencies
Warning
- Location
- skill.json:13
- Finding
- Unpinned npm Package Is Downloaded and Executed Through npx## Vulnerability Details **File Location**: `skill.json:13-23`; also documented in `SKILL.md:89-97` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code `skill.json:13-23`: ```json "install": { "type": "npx", "package": "skillsindex-mcp", "command": "npx", "args": ["skillsindex-mcp"] }, "config": { "mcpServers": { "skillsindex": { "command": "npx", "args": ["skillsindex-mcp"] } } } ``` `SKILL.md:89-97`: ```json { "mcpServers": { "skillsindex": { "command": "npx", "args": ["skillsindex-mcp"] } } } ``` ### Technical Analysis The configuration invokes `npx skillsindex-mcp` without specifying an exact package version or verifying an integrity digest. Consequently, package resolution can retrieve and execute whatever version the npm registry currently associates with the package name. The audited artifact contains only documentation and configuration; it does not contain the package's executable source, a lockfile, or an integrity record. Therefore, statements in `SKILL.md` claiming that the runtime does not read local files, environment variables, or system data cannot be independently verified from this artifact. The effective executable payload can also change after this Skill has been reviewed without requiring any modification to the reviewed files. This is a supply-chain trust issue rather than evidence that the currently published package is malicious. Exploitation would require compromise of the package, its publisher account, the package distribution channel, or another mechanism capable of influencing npm package resolution. ### Attack Path 1. An attacker compromises the `skillsindex-mcp` npm publisher account, package, or relevant distribution infrastructure. 2. The attacker publishes a modified release under the same package name. 3. A user or MCP host loa ...[truncated 1178 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to a specifically audited version, for example by replacing the unversioned package reference with `skillsindex-mcp@<exact-version>`. 2. Use a lockfile and verify the package archive against an expected cryptographic integrity value before execution. 3. Prefer installing from a controlled, reviewed dependency manifest rather than allowing `npx` to resolve and download the package dynamically on every invocation. 4. Vendor the reviewed source or compiled artifact into the project when feasible so the runtime implementation is included within the audit boundary. 5. Automate package provenance, signature, publisher, and integrity verification in the release process. 6. Run the MCP server in a sandbox with minimal filesystem access, a restricted environment, no unnecessary credentials, and an outbound-network allowlist limited to documented endpoints. 7. Review the exact packaged npm artifact—not only the linked repository—to verify that the distributed JavaScript matches the claimed source. 8. Update both `skill.json` and the installation example in `SKILL.md` so users consistently execute the pinned, verified release.