T08 · Insecure Dependencies
Warning
- Location
- references/INSTALL.md:3
- Finding
- Unpinned Remote Repository Installation and Script Execution## Vulnerability Details **File Location**: `references/INSTALL.md:3-14`; also referenced by `SKILL.md:75-79` **Vulnerability Type**: Unpinned third-party repository and dependency execution **Risk Level**: Medium ### Vulnerable Code `references/INSTALL.md:3-14`: ```bash ## Local repo setup ```bash git clone https://github.com/xiaojiou176-open/prooftrail.git cd prooftrail pnpm install ``` ## Start the current repo-native MCP server ```bash pnpm mcp:start ``` ``` `SKILL.md:75-79`: ```markdown 1. clone the ProofTrail repo 2. run `pnpm install` 3. point your MCP client at the repo-local stdio command 4. start the MCP bridge with `pnpm mcp:start` ``` ### Technical Analysis The installation procedure clones the mutable default branch of an external GitHub repository and immediately runs `pnpm install` followed by a repository-defined package script. It does not pin the checkout to a reviewed commit hash or signed release, verify an integrity checksum, require a frozen lockfile, or direct the user to inspect package lifecycle scripts. A pnpm installation can execute package lifecycle scripts, while `pnpm mcp:start` executes the command currently defined by the downloaded repository. The effective code executed by users can therefore change after this Skill has been reviewed. The MCP host configurations also attach that downloaded process to an Agent environment, which may grant it access to inherited environment variables, local files available to the process, network resources, and optional backend credentials. This audit covered only the documentation Skill package and did not contain the external ProofTrail repository's source code. Therefore, no malicious behavior in that repository is asserted; the vulnerability is the absence of controls ensuring that future downloaded code is identical to reviewed code. ### Attack Path 1. An attacker compromises the referenced repository, a maintainer acc ...[truncated 1646 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the repository checkout to a reviewed immutable commit: ```bash git clone https://github.com/xiaojiou176-open/prooftrail.git cd prooftrail git checkout --detach <reviewed-full-commit-hash> ``` 2. Prefer a cryptographically signed release tag and document how users must verify its signature before installation. 3. Publish and verify checksums for release artifacts where applicable. 4. Commit and review `pnpm-lock.yaml`, then require: ```bash pnpm install --frozen-lockfile ``` 5. Review package lifecycle scripts and the exact `mcp:start` definition before execution. Where supported, initially install with lifecycle scripts disabled and explicitly approve only required build steps. 6. Run the MCP server in a sandbox or container with: - A dedicated unprivileged account. - A read-only or narrowly scoped filesystem. - No unnecessary host-directory mounts. - An allowlisted network policy. - Only explicitly required environment variables. 7. Do not pass unrelated credentials or the complete host environment to the MCP process. Store optional backend tokens in a scoped secret mechanism and rotate them if exposure is suspected. 8. Record the reviewed repository commit in both host configuration examples so that operators can verify the configured checkout before launching the server.