ClawHub
Back to skill

Security audit

Pipeworx asana

Security checks for vulnerabilities and agentic risk

Overview

The skill is a simple Asana connector, but it routes OAuth-backed Asana access through an unverified third-party MCP gateway with write capability.

Review who operates gateway.pipeworx.io and what OAuth scopes it requests before authorizing it. Use the least-privileged Asana workspace/project access available, and avoid connecting sensitive workspaces unless you are comfortable with a third-party gateway handling task metadata and task-creation requests.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:29
Finding

Unverified Third-Party MCP Gateway Handles Privileged Asana Operations

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29–35
Vulnerability Type: Third-party service and supply-chain trust risk
Risk Level: Medium

Vulnerable Code

json
{
  "mcpServers": {
    "asana": {
      "url": "https://gateway.pipeworx.io/asana/mcp"
    }
  }
}

Technical Analysis

The skill routes OAuth-backed Asana operations through gateway.pipeworx.io, a third-party MCP endpoint rather than a documented official Asana API endpoint. This gateway becomes a privileged supply-chain dependency between the agent and Asana.

Based on the operations documented in SKILL.md, the gateway may process workspace and project identifiers, task names and descriptions, completion status, assignees, due dates, tags, subtasks, and task-creation requests. The project does not include the gateway implementation, integrity verification, documented OAuth scopes, a privacy policy, or evidence that the service is operated or authorized by Asana. Its behavior therefore cannot be audited from the supplied artifact.

A malicious or compromised gateway could inspect information sent through it, return falsified tool results, or misuse OAuth capabilities granted to the integration. The supplied file does not establish that such abuse is occurring; the vulnerability is the unverified privileged dependency and the resulting trust exposure.

Attack Path

  1. A user installs or loads the MCP configuration from SKILL.md.
  2. The agent connects to https://gateway.pipeworx.io/asana/mcp.
  3. The user authorizes Asana access or invokes one of the documented Asana tools.
  4. Asana requests, task data, and OAuth-authorized operations are routed through the third-party gateway.
  5. If the gateway or its infrastructure is malicious or compromised, it can inspect data passing through the service and potentially return manipulated MCP responses.
  6. Where the granted authorization permits writes, the gateway could potentially misuse task-creation capabilitie ...[truncated 640 chars]
Remediation
View remediation

Remediation Suggestions

  1. Prefer an official Asana-hosted MCP integration, if one is available, or connect an auditable local MCP server directly to the official api.asana.com API.
  2. Publish or independently audit the MCP gateway implementation and its deployment process.
  3. Document the gateway operator, data-retention policy, subprocessors, OAuth flow, and every requested OAuth scope.
  4. Apply least privilege by requesting only the minimum read or write scopes required for each operation.
  5. Separate read-only operations from write operations and require explicit user confirmation before task creation or any other state-changing request.
  6. Restrict OAuth authorization to the minimum necessary workspaces and projects where supported.
  7. Protect OAuth tokens with encryption in transit and at rest, prevent token logging, and support prompt revocation and rotation.
  8. Add endpoint authentication, certificate validation, monitoring, audit logs, and anomaly detection for gateway requests.
  9. Pin and verify any distributable MCP client or server components through reproducible builds, checksums, or signed releases.
  10. Clearly disclose that Asana data is processed by a third-party gateway so users can make an informed trust decision before authorization.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.