T08 · Insecure Dependencies
Warning
- Location
SKILL.md:3- Finding
Unverified Third-Party MCP Gateway Handles Sensitive Applicant Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 3–32
Vulnerability Type: Unverified external service and supply-chain trust boundary
Risk Level: MediumThe skill describes operations that retrieve sensitive applicant information, including names, email addresses, resumes, interview histories, contact details, and application metadata. These operations are routed through
gateway.pipeworx.io, which is a third-party domain rather than a documented official Ashby endpoint.Relevant code:
markdown Ashby MCP Pack — wraps the Ashby ATS API ## ashby_list_candidates Search candidates in your ATS. Returns names, emails, and application metadata. Use ashby_get_candid ## ashby_get_candidate Get full candidate profile by ID. Returns contact info, resume, interview history, and current appli ## ashby_list_jobs Search open positions. Filter by status (open, closed, draft, archived). Returns job title, departme ## ashby_get_job Get full job posting by ID. Returns description, requirements, hiring stage, and applicant count. ## ashby_list_applications Search job applications across positions. Returns candidate name, applied job, application stage, an ```json { "mcpServers": { "ashby": { "url": "https://gateway.pipeworx.io/ashby/mcp" } } }text ### Technical Analysis The configuration establishes a remote MCP server as the implementation behind tools presented as an “Ashby MCP Pack.” The configured host is `gateway.pipeworx.io`, not an official Ashby domain identified by the project documentation. Consequently, sensitive ATS requests and responses may cross an additional, undocumented trust boundary. The project provides no information about: - Ownership or verification of the gateway - Authentication and authorization controls - Requested ATS permission scopes - Data retention or processing policies - Protection of candidate personally ident ...[truncated 2014 chars]- Remediation
View remediation
Remediation Suggestions
- Replace the gateway with an official, organization-approved Ashby endpoint or a locally operated and independently audited connector.
- Verify and document the ownership, security posture, subprocessors, data residency, retention policy, and incident-response process of
gateway.pipeworx.iobefore use. - Clearly disclose that ATS information is routed through a third-party service and obtain appropriate organizational approval and user consent.
- Use read-only, least-privilege ATS credentials restricted to the minimum records and fields required for each operation.
- Avoid returning resumes, contact information, interview histories, or email addresses unless explicitly required and authorized.
- Ensure credentials are not exposed to the gateway where direct authorization or token exchange with Ashby is possible. Use short-lived, revocable tokens and rotate them regularly.
- Apply outbound network allowlisting, TLS certificate validation, access logging, rate limiting, and monitoring for unusual data retrieval.
- Treat remote MCP responses as untrusted data. Validate response schemas, constrain output sizes, and prevent returned content from being interpreted as agent instructions.
- Document the authentication flow and provide administrators with procedures to revoke access and audit which candidate records were accessed.