Pipeworx carbon-interface

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:09 AM UTC
• Version: 1.0.0

Overview

This skill is a small carbon-emissions estimation integration that uses a disclosed external MCP gateway and shows no local code, persistence, or credential access.

Install only if you are comfortable sending the electricity, flight, vehicle, and distance details needed for estimates to the disclosed gateway. Avoid adding personal identifiers or confidential business data unless you trust the gateway operator and its data practices.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unverified Third-Party MCP Gateway

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-25
Vulnerability Type: Unverified external MCP service dependency
Risk Level: Medium

json

{
  "mcpServers": {
    "carbon-interface": {
      "url": "https://gateway.pipeworx.io/carbon-interface/mcp"
    }
  }
}

Technical Analysis

The skill delegates carbon-estimation operations to gateway.pipeworx.io, although it is presented as a Carbon Interface API integration. The documentation does not establish that this intermediary is an official Carbon Interface endpoint, identify its operator, describe its data-handling practices, or provide controls for validating its MCP tool definitions and responses.

Because MCP servers provide tool metadata and process tool requests dynamically, a malicious or compromised gateway could observe submitted electricity, flight, and vehicle information, return manipulated estimates, or expose misleading tool definitions. The reviewed file does not contain local executable code, credentials, installation commands, or evidence that the endpoint directly executes code on the client.

Attack Path

1. A user installs or enables the MCP configuration from SKILL.md.
2. The agent connects to https://gateway.pipeworx.io/carbon-interface/mcp.
3. The gateway supplies MCP tool definitions and receives estimation requests.
4. If the gateway is malicious or compromised, it can collect submitted request data or manipulate tool metadata and estimation results.
5. The agent or user may trust and act on the altered output because the service is presented as a Carbon Interface integration.

Impact Assessment

The gateway can potentially access data explicitly submitted through its MCP tools, including electricity usage, passenger and flight-leg details, travel distances, and vehicle model identifiers. It can also control the responses and tool metadata delivered through that connection.

No evidence shows ...[truncated 307 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the gateway with a verified official Carbon Interface MCP endpoint when one is available.
• If the intermediary is required, document its ownership, authorization relationship, privacy policy, retention practices, and security guarantees.
• Require explicit user consent before sending flight, vehicle, or electricity data to the external service.
• Apply an allowlist for expected MCP tools and validate tool names, schemas, and returned data before use.
• Restrict the MCP connection to the minimum capabilities necessary and do not grant filesystem, shell, credential, or unrelated network access.
• Avoid submitting personal identifiers or other sensitive information that is unnecessary for emissions calculations.
• Monitor endpoint ownership and TLS certificate changes, and establish a process for disabling the integration if the gateway is compromised.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.