T08 · Insecure Dependencies
Error
- Location
- references/INSTALL.md:11
- Finding
- Unpinned External Repository and Dependency Execution## Vulnerability Details **File Location**: `references/INSTALL.md`, lines 11-25 **Vulnerability Type**: Supply-chain risk caused by retrieving, installing, building, and executing unpinned external code **Risk Level**: High **Vulnerable Code**: ```bash git clone https://github.com/xiaojiou176-open/campus-copilot.git cd campus-copilot pnpm install ``` ```bash pnpm --filter @campus-copilot/mcp-server build ``` ```bash pnpm --filter @campus-copilot/mcp-server start ``` ### Technical Analysis The installation instructions clone the default branch of an external Git repository without specifying an immutable commit hash or verified signed tag. Consequently, the code installed by an operator can change after this Skill package has been reviewed. The subsequent `pnpm install` operation installs third-party dependencies and may execute package lifecycle scripts. The instructions then build and start the retrieved MCP server. These operations execute code from the unpinned repository and its dependency graph with the permissions of the host user. Although the documentation characterizes the server as read-only, this package does not contain or verify the server implementation. The stated application-level behavior therefore does not enforce operating-system-level restrictions on the external process. ### Attack Path 1. An attacker compromises the upstream repository, its default branch, a maintainer account, or one of its package dependencies. 2. The attacker inserts malicious code into the MCP server, a build script, or an installation lifecycle script. 3. An operator follows the documented `git clone` and `pnpm install` procedure. 4. The malicious code executes during dependency installation, the build, or `pnpm ... start`. 5. The code receives the permissions and resource access available to the host user and MCP process. 6. It can potentially access or alter locally available files, environment variables, ...[truncated 701 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the repository to a reviewed, immutable commit hash or cryptographically verified signed release: ```bash git clone https://github.com/xiaojiou176-open/campus-copilot.git cd campus-copilot git checkout --detach <reviewed-commit-hash> ``` 2. Verify the checked-out commit or release signature before installing dependencies. 3. Commit and review the dependency lockfile, then install with: ```bash pnpm install --frozen-lockfile ``` 4. Disable dependency lifecycle scripts during initial installation where compatible: ```bash pnpm install --frozen-lockfile --ignore-scripts ``` Any required scripts should be separately reviewed before execution. 5. Run dependency integrity, provenance, and vulnerability checks before building. 6. Execute the MCP server in a sandbox or container with a dedicated unprivileged account, a restricted environment, read-only input mounts, a dedicated output directory, and deny-by-default network access. 7. Do not forward unrelated credentials or environment variables to the MCP process. 8. Document the exact reviewed repository commit alongside the Skill version so later installations reproduce the audited implementation.