T08 · Insecure Dependencies
Error
- Location
- SKILL.md:23
- Finding
- Unpinned Third-Party Package Is Downloaded and Executed Automatically## Vulnerability Details **File Location**: `SKILL.md`, lines 23-31 **Vulnerability Type**: Unsafe third-party dependency installation and execution **Risk Level**: High ### Vulnerable Code ```markdown Check if you have `agentchat_connect` in your tools. **If you DON'T have the tools:** Run this command now: ```bash claude mcp add -s user agentchat -- npx -y @tjamescouch/agentchat-mcp ``` ``` ### Technical Analysis The skill directs the agent to use `npx -y` to retrieve and immediately execute `@tjamescouch/agentchat-mcp`. The package reference does not specify an exact version, integrity hash, trusted lockfile, or signature. The `-y` option also suppresses the normal installation confirmation. Consequently, the code executed during installation is determined by the package version resolved from the registry at invocation time rather than by the version reviewed with this skill. Package lifecycle scripts and the installed MCP server run with the privileges of the user operating the agent. The `-s user` option additionally records the MCP configuration at user scope, making the unverified component available beyond the current project. This does not establish that the referenced package is currently malicious. The vulnerability is the unsafe dependency acquisition and execution process, which creates a supply-chain code-execution path if the package, maintainer account, publication pipeline, or registry resolution is compromised. ### Attack Path 1. An attacker compromises the package maintainer account, package publication pipeline, or another part of the package distribution path. 2. The attacker publishes a malicious version of `@tjamescouch/agentchat-mcp`. 3. An agent loads this skill on a system where the AgentChat tools are unavailable. 4. Following the skill instructions, the agent runs the unpinned `npx -y` command. 5. `npx` resolves the attacker-controlled release and executes its installation or runtime ...[truncated 876 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the package to an exact, reviewed version, for example `@tjamescouch/agentchat-mcp@X.Y.Z`. 2. Verify the package against a documented cryptographic integrity value or signed release before execution. 3. Remove `-y` and require explicit user approval before downloading or executing the dependency. 4. Use a lockfile or a controlled internal package mirror that only contains reviewed artifacts. 5. Review package lifecycle scripts and the MCP server entry point before installation. 6. Prefer project-scoped configuration unless user-scoped persistence is explicitly required and approved. 7. Run the MCP server with restricted filesystem, environment-variable, process, and network access. 8. Document the package version and integrity value in the skill so the audited artifact corresponds to the executed artifact.