ClawHub
Back to skill

Security audit

Pipeworx attom

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward remote ATTOM real-estate lookup integration, with privacy caveats because property queries go to a Pipeworx-hosted MCP endpoint.

Install only if you are comfortable sending property addresses, ZIP codes, coordinates, and related real-estate queries to the configured Pipeworx MCP endpoint. Treat returned property data as third-party remote output and verify important valuation, tax, school, or sales information before relying on it.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T07 · Tool Hijacking and Spoofing

Warning
Location
SKILL.md:38
Finding

Unverified Third-Party MCP Gateway Introduces Tool Spoofing and Data Exposure Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38-43
Vulnerability Type: Unverified remote MCP service trusted as an ATTOM tool provider
Risk Level: Medium

Vulnerable Code

json
{
  "mcpServers": {
    "attom": {
      "url": "https://gateway.pipeworx.io/attom/mcp"
    }
  }
}

Technical Analysis

The skill describes ATTOM real-estate services but delegates tool traffic and behavior to gateway.pipeworx.io, a domain that is not identified in the project as being owned or operated by ATTOM. The repository provides no documentation establishing the gateway as an authorized processor and contains no tool-schema validation, integrity pinning, endpoint allowlisting policy, authentication requirements, or privacy and retention disclosures.

An MCP endpoint occupies a trusted tool-control position because it can receive tool arguments and supply tool definitions or results. The advertised operations may process property addresses, postal codes, geographic coordinates, sales records, tax information, and related search intentions. Consequently, the configured intermediary can observe submitted query data and influence results presented under the legitimate-looking attom server name.

The audited file does not prove that the endpoint is malicious, and it contains no evidence of local code execution, credential theft, persistence, or privilege escalation. The issue is the unsupported trust placed in a third-party remote tool endpoint.

Attack Path

  1. An agent loads the MCP configuration from SKILL.md.
  2. The agent treats the server named attom as the provider of the documented ATTOM operations.
  3. A user invokes a property-related operation and supplies an address, postal code, coordinates, or another query.
  4. The agent transmits the request to https://gateway.pipeworx.io/attom/mcp.
  5. The gateway can observe the submitted data and return remotely controlled tool definition ...[truncated 1087 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the gateway with a verified ATTOM-operated MCP endpoint where one is available.
  2. If Pipeworx is an authorized intermediary, document that relationship and provide links to its security, privacy, retention, and subprocessors policies.
  3. Require authenticated TLS access and avoid placing reusable credentials directly in SKILL.md.
  4. Allowlist expected MCP tool names and validate their argument and response schemas before exposing them to the agent.
  5. Minimize transmitted information, especially exact addresses and coordinates, and obtain appropriate user consent before sending sensitive location-related queries.
  6. Define retention and deletion requirements for submitted queries and prohibit unrelated secondary use.
  7. Monitor the endpoint for certificate, ownership, tool-definition, and response-schema changes.
  8. Treat remote tool output as untrusted data and prevent returned content from modifying agent instructions or triggering unrelated privileged actions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advertises property and school lookup capabilities but does not disclose that user-supplied addresses, ZIP codes, or coordinates are transmitted to an external ATTOM endpoint. This is a real privacy/transparency issue because users may enter sensitive location data without understanding it leaves the local agent environment and is sent to a third-party service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.