[eeee2345]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

Check 3 of mcp-security-audit (dependency pinning) recognizes the JavaScript package runners added in #3852. Many Python MCP servers are documented with uvx (for example "command": "uvx", "args": ["mcp-server-fetch"]), and those entries currently fall through to the generic "could not be classified statically" INFO finding. That is safe, but it means a bare uvx my-mcp-server and a pinned uvx --from my-mcp-server==2.1.0 my-mcp-server get the same result.

This change teaches the extractor three Python launchers:

• uvx and uv tool run: the positional requirement, or the --from requirement when present
• pipx run: the positional app, or the --spec requirement when present

Python runners use their own flag sets. For uvx, -p means --python, so it is not read as a package selector; any flag the extractor does not know still returns the manual-review INFO result, as before. Python requirement parsing (==, >=, extras) only applies to these launchers, so JavaScript runner results do not change.

Version handling: pkg==1.2.0 and pkg[extra]==1.0rc1 count as exact, pkg@1.2.0 (uvx syntax) goes through the existing semver check, bare names and @latest are MEDIUM, and ranges such as >=1.0, ~=1.2 or ==1.* are LOW. Wording, severities and the "pin what you actually reviewed" guidance are unchanged. I also added uvx/pipx lines to the good/review examples and the skill description.

Git, URL, and local path sources (git+https://...@v1.0.0, pkg @ https://..., ./pkg) return the manual-review INFO result, since a tag or file can change behind an exact-looking ref. --with extra requirements and uv run (project-local, not a package runner) also stay on manual review. Exact pins written as uvx pkg@1.2 or with a local version (==1.0+local) are reported as LOW, which errs on the cautious side.

---

Type of Contribution

• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.

---

Additional Notes

Validation:

• npm run skill:validate: all skills valid
• npm start: regenerated docs/README.skills.md; only the mcp-security-audit description line changed
• git diff --check: clean
• I ran the Check 3 code block from the file against hand-written cases for each launcher (bare, @latest, @x.y.z, --from/--spec with ==, ranges, extras, wildcards, git tags, local paths, uvx -p 3.12, uv run, pipx install). Before this change every uvx / uv tool run / pipx run case returned INFO; after it they return the results described above.
• To check that JavaScript behaviour is unchanged, I compared the old and new code block over every combination of the JavaScript runners plus node/python/docker, a set of selectors (including odd ones like a==1.0.0 and git URLs), and several flag shapes. The results were identical.

I have not run the skill through Copilot itself; the test was the Python code in the skill.

The code change and the test cases were drafted with an AI assistant; I reviewed the diff and re-ran the cases locally.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🔒 PR Risk Scan Results

Scanned 1 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	13
ℹ️ Info	0

Severity	Rule	File	Line	Match
🟠	package-exec-command	skills/mcp-security-audit/SKILL.md	8	- Detecting mutable npm/npx, bunx, pnpm dlx, yarn dlx, npm exec, uvx, uv tool run, and pipx run references in MCP configurations
🟠	package-exec-command	skills/mcp-security-audit/SKILL.md	161	PYTHON_RUNNERS = {"uvx", "uvx.exe", "uv", "uv.exe", "pipx", "pipx.exe"}
🟠	package-exec-command	skills/mcp-security-audit/SKILL.md	203	# uvx -p means --python, so only the requirement flags name packages.
🟠	package-exec-command	skills/mcp-security-audit/SKILL.md	214	elif command not in {"npx", "npx.cmd", "bunx", "bunx.cmd"}:
🟠	package-exec-command	skills/mcp-security-audit/SKILL.md	275	{ "command": "npx", "args": ["-y", "my-mcp-server@​​2.1.0"] }
🟠	package-exec-command	skills/mcp-security-audit/SKILL.md	276	{ "command": "uvx", "args": ["my-mcp-server@​​2.1.0"] }
🟠	package-exec-command	skills/mcp-security-audit/SKILL.md	277	{ "command": "uvx", "args": ["--from", "my-mcp-server==2.1.0", "my-mcp-server"] }
🟠	package-exec-command	skills/mcp-security-audit/SKILL.md	282	{ "command": "npx", "args": ["-y", "my-mcp-server@​​latest"] }
🟠	unpinned-version-indicator	skills/mcp-security-audit/SKILL.md	282	{ "command": "npx", "args": ["-y", "my-mcp-server@​​latest"] }
🟠	package-exec-command	skills/mcp-security-audit/SKILL.md	283	{ "command": "npx", "args": ["-y", "my-mcp-server"] }
🟠	package-exec-command	skills/mcp-security-audit/SKILL.md	284	{ "command": "npx", "args": ["-y", "@​​scope/server@​​^2.1.0"] }
🟠	package-exec-command	skills/mcp-security-audit/SKILL.md	285	{ "command": "uvx", "args": ["my-mcp-server"] }
🟠	package-exec-command	skills/mcp-security-audit/SKILL.md	289	The extractor reviews every explicit `--package` / `-p` selector for JavaScript runners, and every `--from` (`uvx`, `uv tool run`) or `--spec` (`pipx run`) requirement for Python r

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🚦 Submission status: 👀 Ready for review

Risk tier: merge-risk:medium — New or substantially changed resource without privileged execution
Required to merge: passing submission-gate checks plus 1 approval from reviewers with write access.

Why this tier

• Changes 57 lines (low-risk limit is 40)

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Generated README consistency	✅ Passed	Passed · logs
Skill validation	✅ Passed	Passed · logs
Skill lint (vally)	✅ Passed	Passed · logs
Risk scan	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	⏭️ Skipped	Skipped by its workflow · logs

Review

• Approvals: 0/1
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 1 more approval(s)
• No staffed reviewer pool owns these files yet; any reviewer with write access counts as the domain reviewer.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for de274d0 · gate run · This comment is maintained automatically — see submission gate docs.}

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[github-actions]

🔍 Vally Lint Results

✅ All checks passed

Scope	Checked
Skills	1
Agents	0
Total	1

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	0

Summary

Level	Finding
ℹ️	✅ mcp-security-audit (2/2 checks passed)
ℹ️	✓ [spec-compliance] All 1 skill(s) are spec-compliant.
ℹ️	✓ spec-compliance: All spec checks passed.
ℹ️	✓ [valid-refs] All file references across 1 skill(s) are valid.
ℹ️	✓ valid-refs: All file references resolve to existing files within the skill directory.
ℹ️	1 skill(s) linted, 1 passed

Full linter output

### Linting skills/mcp-security-audit
✅ mcp-security-audit (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

[aaronpowell]

Thanks—this is a useful, focused extension of the MCP pinning audit. The distinction between uvx -p and package selectors, plus the conservative handling of unsupported Python source forms, adds actionable coverage without changing the existing JavaScript behavior.