T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:32
- Finding
- Unpinned npm Package Is Downloaded and Executed Without Confirmation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:32-34, 52-54, 60-64, 69-71`; `references/README.md:22-24, 50-52, 59-63` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code `SKILL.md:32-34`: ```bash npx -y @aimino/opentalk2html-notmd ``` `SKILL.md:60-64`: ```json { "mcpServers": { "open-talk-2-html-not-md": { "command": "npx", "args": ["-y", "@aimino/opentalk2html-notmd"] } } } ``` The same unpinned command is repeated in `SKILL.md:52-54` and `SKILL.md:69-71`, as well as in `references/README.md:22-24`, `references/README.md:50-52`, and `references/README.md:59-63`. Version metadata is inconsistent. `SKILL.md:1-9` declares: ```yaml --- id: fast-html-mcp name: OpenTalk2HTML-NotMD MCP Server summary: >- Generate, patch, read, and compress HTML pages for reports, dashboards, and docs — AI talks to you through beautiful pages, not markdown dumps. 18 tools, 22 components, 25+ templates with sub-second patch times. published_date: '2026-05-21' version: '1.1.0' ``` However, `references/package.json:1-4` identifies a different version: ```json { "name": "@aimino/opentalk2html-notmd", "version": "0.1.2", "description": "OpenTalk2HTML-NotMD MCP Server — AI talks to you through beautiful HTML pages instead of overwhelming markdown dumps. Five-tier architecture with 18 tools, 22 components, 25+ templates.", ``` `references/server.json:6-13` also identifies version `0.1.2`: ```json "version": "0.1.2", "packages": [ { "registryType": "npm", "identifier": "@aimino/opentalk2html-notmd", "version": "0.1.2", "transport": { "type": "stdio" } ``` ### Technical Analysis The documented launch command uses `npx -y` with no exact package version. When invoked, npm resolves and downloads the package version available from the registry at execution time. The `-y` option suppresses the interactive installation confirmation. ...[truncated 2517 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the command to an exact, reviewed package version: ```bash npx -y @aimino/opentalk2html-notmd@0.1.2 ``` Update the MCP configuration similarly: ```json { "mcpServers": { "open-talk-2-html-not-md": { "command": "npx", "args": ["-y", "@aimino/opentalk2html-notmd@0.1.2"] } } } ``` 2. Reconcile the version declarations in `SKILL.md`, `references/package.json`, and `references/server.json` so they identify the same reviewed release. 3. Include the executable source or packaged `dist/index.js` in the audit artifact so the actual MCP implementation can be reviewed. 4. Use a lockfile and verify npm package integrity hashes in controlled deployment workflows. Retain the reviewed package tarball or use an internal immutable registry where appropriate. 5. Avoid resolving packages dynamically whenever the MCP client starts. Install the reviewed package during a controlled deployment step and launch the fixed local executable. 6. Run the MCP server with least privilege: - Restrict filesystem access to designated input and output directories. - Do not expose unrelated credentials through environment variables. - Restrict outbound network access unless explicitly required. - Use a container or operating-system sandbox where possible. 7. Monitor the package for ownership changes, unexpected releases, integrity changes, and security advisories before approving upgrades. ]]>