Pipeworx chargebee

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:37 AM UTC
• Version: 1.0.0

Overview

This Chargebee skill is read-only and purpose-aligned, but it routes sensitive customer and billing data through an unverified third-party MCP gateway with little privacy or access-control disclosure.

Install only if you trust the gateway operator and can limit the Chargebee credentials to the minimum read-only scopes needed. Treat returned customer, invoice, address, and payment-method metadata as sensitive, avoid unnecessary lookups, and confirm how the gateway handles credentials, logging, retention, and subprocessors before using it with production data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25

Finding

Unverified Third-Party MCP Gateway Handles Sensitive Chargebee Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25–33
Vulnerability Type: Unverified third-party service dependency
Risk Level: Medium

Vulnerable Code:

json

{
  "mcpServers": {
    "chargebee": {
      "url": "https://gateway.pipeworx.io/chargebee/mcp"
    }
  }
}

Technical Analysis

The Skill configures an external MCP service hosted at gateway.pipeworx.io, rather than an endpoint demonstrably controlled by Chargebee. The surrounding documentation advertises operations that return sensitive subscription and customer information, including names, email addresses, billing addresses, payment methods, invoices, and billing dates.

The package contains no local MCP implementation, integrity pinning, authentication constraints, privacy documentation, or other evidence through which the gateway's implementation and Chargebee-only behavior can be verified. Consequently, users must trust an unaudited third-party component to process MCP requests and responses.

This is a supply-chain and trust-boundary concern. If the gateway is malicious, compromised, or incorrectly configured, it could inspect sensitive requests and responses, modify returned billing data, or expose tools whose behavior differs from the Skill documentation. The reviewed artifact does not establish that such compromise has occurred; the risk arises from routing sensitive operations through an unverifiable external dependency.

Attack Path

1. A user installs or activates the MCP configuration from SKILL.md.
2. The Agent connects to https://gateway.pipeworx.io/chargebee/mcp.
3. The Agent invokes one of the advertised customer, subscription, or invoice operations.
4. Chargebee identifiers, request parameters, credentials or tokens supplied through the MCP integration, and returned billing data may be processed by the third-party gateway.
5. If the gateway is compromised or malicious, it can observe available da ...[truncated 996 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an official Chargebee-controlled MCP endpoint where one is available.
2. Alternatively, provide an auditable local MCP implementation that communicates directly with the official Chargebee API.
3. Document the gateway operator, authentication flow, credential handling, retention policy, subprocessors, and privacy guarantees before requesting sensitive data.
4. Restrict Chargebee credentials to the minimum scopes and read-only operations required by the advertised tools.
5. Minimize returned fields so payment-method metadata, addresses, and other personal information are not exposed unless explicitly required.
6. Pin or version the remote component where supported and establish integrity and provenance verification for gateway updates.
7. Apply endpoint allowlisting, certificate validation, logging, monitoring, and credential rotation.
8. Require explicit user confirmation before transmitting or retrieving sensitive customer and billing information through the third-party gateway.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill advertises operations that retrieve customer profiles, subscriptions, invoices, billing addresses, and payment-method-related data, but provides no warning, minimization guidance, or access-control expectations for handling sensitive financial/account information. In an MCP context, this can normalize broad access to personal and billing data and increase the risk of over-collection, accidental disclosure, or unsafe downstream use by agents or users.

Content

No source excerpt is available for this finding.