T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:28
- Finding
- Unpinned Remote npm Package Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 28–39 **Vulnerability Type**: Unpinned third-party dependency executed through `npx` **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "daily-to-goal": { "command": "npx", "args": ["@daily-to-goal/mcp-server"], "env": { "DTG_API_KEY": "dtg_live_your_key_here" } } } } ``` ### Technical Analysis The configuration directs the MCP host to resolve and execute `@daily-to-goal/mcp-server` through `npx` without specifying an exact package version or integrity hash. The package implementation is not included in the audited project, so its behavior cannot be verified from the available source. Because package resolution occurs against an external registry, the code eventually executed can change after this skill has been reviewed. A compromised publisher account, package takeover, or malicious future release could place attacker-controlled code in the MCP server process. That process is explicitly provided with `DTG_API_KEY` and runs with the local privileges of the user launching the MCP host. This finding concerns the unsafe dependency execution mechanism. The audit did not establish that the current npm package version is malicious. ### Attack Path 1. An attacker compromises the npm publisher account, takes control of the package, or otherwise causes a malicious release of `@daily-to-goal/mcp-server` to be published. 2. A user applies the documented configuration and starts the MCP integration. 3. `npx` resolves the unpinned package version from the external npm registry. 4. The downloaded package executes locally as the MCP server. 5. The malicious package reads `DTG_API_KEY` from its process environment. 6. It exfiltrates the credential or uses it to invoke Daily-to-Goal operations allowed by the key's scopes and the associated account role. 7. Because it is native code execution through Node.js, it may also access local resources avai ...[truncated 835 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the MCP package to a reviewed, exact version rather than resolving the latest available release: ```json { "mcpServers": { "daily-to-goal": { "command": "npx", "args": ["--yes", "@daily-to-goal/mcp-server@1.2.3"], "env": { "DTG_API_KEY": "${DTG_API_KEY}" } } } } ``` 2. Verify the package's official name, publisher identity, repository, release provenance, and integrity before installation. 3. Prefer a controlled installation governed by a lockfile and package-integrity metadata instead of downloading the dependency dynamically on every invocation. 4. Review new releases before updating the pinned version. Use automated supply-chain scanning and monitor publisher or ownership changes. 5. Run the MCP server in a sandbox or restricted account with minimal filesystem, environment, and network access. 6. Provision a dedicated API key with only the scopes necessary for the intended operations. Avoid broad write or administrative permissions when read-only access is sufficient. 7. Store the real API key in an environment variable or secrets manager, never directly in a committed configuration file. 8. Rotate and revoke the credential promptly if dependency compromise is suspected. 9. Add the referenced `references/security.md` document or remove the broken reference so users can access the promised security guidance.