ClawHub
Back to skill

Security audit

Pipeworx cdc

Security checks for vulnerabilities and agentic risk

Overview

This is a small read-only CDC public-data MCP skill, with the main caveat that it uses a visible third-party gateway instead of an official CDC endpoint.

Before installing, treat the gateway as a third-party data processor and verify that you are comfortable sending CDC dataset searches and dataset IDs through it. Do not use it for private prompts, credentials, or sensitive health information unless the gateway operator and privacy terms are acceptable to you.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:13
Finding

Undisclosed Third-Party MCP Gateway Introduces an External Trust Boundary

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:13-19
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

json
{
  "mcpServers": {
    "cdc": {
      "url": "https://gateway.pipeworx.io/cdc/mcp"
    }
  }
}

Technical Analysis

The skill describes itself as a wrapper for CDC open data available through data.cdc.gov, but its configuration directs the agent to gateway.pipeworx.io, a separate third-party domain. The package provides no local implementation, integrity validation, ownership statement, privacy disclosure, authentication constraints, or evidence that this gateway is operated by or affiliated with the CDC.

Configuring this endpoint delegates MCP tool definitions, query processing, and returned content to an externally controlled service. This creates a trust boundary beyond what is necessary to retrieve public CDC Socrata data directly. The remote service may observe dataset searches and requested identifiers, alter responses, or change its behavior after the skill has been reviewed.

The audited content does not establish that the gateway is malicious, and there is no evidence of local code execution, credential theft, persistence, or direct prompt injection. The risk arises from undisclosed third-party control over the MCP interface and data flow.

Attack Path

  1. A user installs or activates the MCP configuration from SKILL.md.
  2. The agent connects to https://gateway.pipeworx.io/cdc/mcp rather than directly to the documented CDC Socrata API.
  3. Dataset search terms, requested dataset identifiers, and associated MCP request metadata are transmitted to the third-party gateway.
  4. The gateway supplies tool definitions and responses to the agent.
  5. If the gateway is compromised or behaves deceptively, it can return manipulated public-health data or modify exposed tool behavior.
  6. The agent or user may rely on those responses as ...[truncated 876 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the third-party MCP gateway with direct access to the documented CDC Socrata API at data.cdc.gov where practical.
  2. If the gateway is required, clearly disclose its operator, purpose, CDC affiliation status, privacy policy, retention practices, and all data transmitted to it.
  3. Restrict the MCP server to the minimum operations required for public dataset search and retrieval.
  4. Do not send credentials, personal information, private prompts, or unrelated session context to the gateway.
  5. Validate returned dataset identifiers, schemas, source URLs, and records against the official CDC Socrata service.
  6. Pin or otherwise validate the expected MCP interface and reject unapproved tool-definition changes.
  7. Apply connection timeouts, response-size limits, strict schema validation, and output sanitization.
  8. Document the external trust boundary in the skill description so users can make an informed decision before activation.
  9. Perform an independent security and privacy review of the gateway operator before production use.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.