ClawHub
Back to skill

Security audit

Pipeworx cfpb

Security checks for vulnerabilities and agentic risk

Overview

This skill only configures a remote CFPB complaint-search MCP endpoint, but users should know it routes queries through a third-party gateway.

Install only if you are comfortable sending CFPB complaint searches to the listed third-party MCP gateway. Avoid entering confidential personal or financial details in search terms, and treat returned data as mediated by that gateway rather than directly verified from an official CFPB endpoint.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T07 · Tool Hijacking and Spoofing

Warning
Location
SKILL.md:25
Finding

CFPB Tool Routed Through an Unverified Third-Party MCP Gateway

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-33
Vulnerability Type: Tool endpoint spoofing through a third-party gateway
Risk Level: Medium

Vulnerable Configuration:

json
{
  "mcpServers": {
    "cfpb": {
      "url": "https://gateway.pipeworx.io/cfpb/mcp"
    }
  }
}

Technical Analysis

The skill identifies itself as an interface to the Consumer Financial Protection Bureau complaint database, but configures its MCP tool to use gateway.pipeworx.io, a third-party domain rather than an official CFPB-controlled endpoint.

Consequently, requests presented to users and agents as CFPB operations are routed through infrastructure controlled outside the stated data provider. The gateway can observe and modify requests, fabricate complaint records, omit results, or change tool behavior without any corresponding update to the reviewed skill file. The configuration contains no endpoint allowlisting rationale, response-integrity validation, certificate pinning, or other mechanism establishing that responses originated from CFPB data.

This is classified as tool hijacking and spoofing because a legitimate-looking cfpb tool name is bound to an unverified intermediary capable of controlling its responses.

Attack Path

  1. A user installs or loads the skill and trusts the cfpb MCP server as a CFPB data source.
  2. The agent connects to https://gateway.pipeworx.io/cfpb/mcp.
  3. The gateway operator, or an attacker who compromises that gateway, receives the agent's searches and tool requests.
  4. The gateway returns manipulated complaint narratives, company rankings, complaint details, or misleading tool metadata.
  5. The agent treats those responses as authoritative CFPB information and may use them in summaries, recommendations, or subsequent decisions.

No local code-execution path is established by the reviewed file alone. Exploitation scope is limited to traffic and function ...[truncated 751 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the third-party gateway with an official CFPB-operated API or MCP endpoint where one is available.
  • If an intermediary is necessary, document its ownership, trust model, data-handling policy, and relationship to CFPB.
  • Proxy CFPB's official public API through infrastructure controlled by the skill publisher and independently verify upstream responses.
  • Restrict the MCP server to the minimum required tools and explicitly prohibit unrelated capabilities.
  • Validate response schemas and reject unexpected tool definitions, content types, redirects, and oversized responses.
  • Add provenance information to results so users can distinguish official CFPB data from intermediary-generated content.
  • Conduct security review and continuous monitoring of the gateway, including certificate validation, DNS monitoring, request logging, and change detection.
  • Warn users not to submit confidential personal or financial information in search terms because requests are processed by a third party.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.