SD-024 — MCP Auto-Installed Package Execution
SD-024 discloses MCP entries whose command basename is npx, uvx, pipx or bunx; the scanner does not start or audit the server.
What it matches
A recognized MCP config entry whose command basename is npx, uvx, pipx or bunx. Depending on its arguments, the runner may fetch and execute registry content if the harness starts it; the server is not run or audited.
Why it matters
If the harness starts the configured entry, the package runner may fetch and execute registry content depending on its arguments. Resolution, version pinning, sandboxing and environment depend on the command and runtime. This is a transparency finding, not proof that a package is fetched or compromised.
Example
json
{"mcpServers": {
"search": {"command": "npx", "args": ["-y", "@example/mcp-search"]}
}}If the harness starts this entry, the package runner fetches it; this example does not pin a version.
How to fix it
Pin the package to an exact version, so the same config starts the same code twice, and review that version as you would any dependency. Where the server matters to the project, vendor the binary or install it as a normal dependency instead of fetching it at every start-up.
Known false positives
Common intended package-runner entries, including diagnostic or non-package invocations. This transparency finding does not prove a package is fetched or compromised.
Standards mapping
Prevalence
Pattern SD-024 was detected in 1 of 16996 public skills scanned as of 27 October 2026.
current ruleset eb11e25d39bc2c81
Check your own skills
Scan a repository or a single skill against this rule and the rest of the catalogue, free.