T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:58
- Finding
- Unpinned Third-Party MCP Packages Are Automatically Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 58-70 **Vulnerability Type**: Supply-chain risk from unpinned automatically executed dependencies **Risk Level**: Medium ### Vulnerable Code ```json // .vscode/mcp.json { "mcpServers": { "filesystem": { "command": "npx", "args": ["-y", "@anthropic/mcp-filesystem"] }, "github": { "command": "npx", "args": ["-y", "@anthropic/mcp-github"], "env": { "GITHUB_TOKEN": "${env:GITHUB_TOKEN}" } } } } ``` ### Technical Analysis The documented MCP configuration invokes `npx` with the `-y` option and package names that have no pinned versions. This causes npm packages to be retrieved and executed without interactive confirmation while allowing the resolved package contents to change after the Skill has been reviewed. The configuration does not specify exact audited versions, package integrity hashes, a lockfile, or other provenance controls. Consequently, compromise or replacement of a referenced package or one of its transitive dependencies could result in arbitrary code running with the privileges of the VS Code or Roo Code process. The GitHub MCP server additionally receives `GITHUB_TOKEN` through its environment. Any code executed as that server can potentially read the token, making dependency compromise particularly significant. ### Attack Path 1. An attacker compromises, replaces, or otherwise influences a referenced npm package or one of its transitive dependencies. 2. A user copies the documented configuration into `.vscode/mcp.json`. 3. Roo Code starts the configured MCP server by running `npx -y` with the unpinned package name. 4. `npx` retrieves the package version currently resolved by the registry and executes it without confirmation. 5. Malicious package code executes under the user's account. 6. For the GitHub server, the code reads `GITHUB_TOKEN` from its process environment and ...[truncated 814 chars]
- Remediation
- ## Remediation Suggestions 1. Confirm and document the official, current package identifiers before recommending them. 2. Pin every MCP package to an exact reviewed version rather than relying on registry resolution of an unversioned package name. 3. Install dependencies through a committed lockfile and use a reproducible installation mechanism such as `npm ci`. 4. Verify package provenance, publisher identity, signatures where available, and integrity hashes before execution. 5. Avoid `npx -y` for security-sensitive integrations because it suppresses confirmation before download and execution. 6. Prefer a locally installed, reviewed executable referenced by a fixed path in the MCP configuration. 7. Review and pin transitive dependencies as part of the dependency audit. 8. Supply a dedicated, short-lived GitHub token with only the repository and operation scopes strictly required by the MCP server. 9. Run MCP servers in a sandbox or container with restricted filesystem, environment-variable, and network access. 10. Document package verification and update procedures so version changes require review before deployment.