T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:24
- Finding
- Unpinned Third-Party Dependencies and Mutable Source Code Are Installed and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 24–30, 54–61, and 252–253 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code Lines 24–30: ```bash npm install -g zubeid-youtube-mcp-server ``` ```bash # yt-dlp for transcript extraction pip install yt-dlp ``` Lines 54–61: ```bash # Build from source (if installed package has issues) cd /tmp git clone https://github.com/ZubeidHendricks/youtube-mcp-server cd youtube-mcp-server npm install npm run build ``` Lines 252–253: ```bash pip install --user yt-dlp # or pipx install yt-dlp ``` ### Technical Analysis The installation instructions do not pin exact npm or Python package versions, verify package integrity, or lock transitive dependencies. The source-build fallback also clones the current state of a remote repository without selecting a reviewed commit or verifying a signature or checksum. The global npm installation and the source-build workflow may execute package lifecycle and build scripts. Consequently, the effective code executed by users can change after this Skill has been reviewed. A compromise of the package registry entry, upstream maintainer account, Git repository, default branch, or any transitive dependency could introduce arbitrary code into the installation process. The source repository is cloned into the shared `/tmp` directory using a predictable directory name. Although the audit did not establish a concrete local attack through that path, isolated and uniquely named build directories would provide stronger protection. The dependencies are relevant to the declared YouTube research functionality, but global installation, mutable source retrieval, and unverified build-script execution exceed the minimum safe privileges required to provide that functionality. ### Attack Path 1. An attacker compromises the upstream npm package, Python package, Git repository, maintainer account, or a transitive dependency. 2. The atta ...[truncated 1300 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin exact npm and Python package versions rather than installing the latest available releases. 2. Commit and enforce dependency lockfiles with integrity hashes for all transitive dependencies. 3. Pin the Git workflow to a specific, reviewed commit hash instead of the mutable default branch. 4. Verify release signatures, provenance attestations, or published checksums before installation. 5. Avoid global npm installation. Install dependencies in a dedicated, least-privileged project directory or isolated container. 6. Use a Python virtual environment or `pipx` with a pinned version and verified package source. 7. Review package lifecycle scripts and disable them with `--ignore-scripts` where the dependency can operate without them. 8. Build in a uniquely created private temporary directory rather than a predictable shared `/tmp/youtube-mcp-server` path. 9. Run dependency installation without unrelated secrets in the environment. Provide `SKILLBOSS_API_KEY` only to the process that needs to authenticate. 10. Periodically scan pinned packages and lockfiles for known vulnerabilities and unexpected ownership or provenance changes. ]]>