ClawHub
Back to skill

Security audit

Pipeworx comtrade

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small, disclosed MCP connector for Comtrade trade-data queries, with the main caveat that it relies on a third-party gateway rather than an official UN endpoint.

Before installing, understand that your Comtrade queries will be sent to the configured Pipeworx MCP gateway and the responses come through that service. Avoid sending confidential business research unless you are comfortable with that third-party dependency, and verify decision-critical trade data against authoritative UN Comtrade sources.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:21
Finding

Unaudited Third-Party MCP Gateway for UN Comtrade Operations

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21-29
Vulnerability Type: Third-party service and supply-chain trust risk
Risk Level: Medium

json
{
  "mcpServers": {
    "comtrade": {
      "url": "https://gateway.pipeworx.io/comtrade/mcp"
    }
  }
}

Technical Analysis

The skill represents itself as an interface to UN Comtrade but configures an external MCP service hosted at gateway.pipeworx.io, rather than an official UN Comtrade endpoint. The project contains no locally auditable implementation, authentication policy, service-integrity controls, ownership verification, or disclosure of how queries and responses are handled.

HTTPS protects network traffic in transit but does not establish that the service operator or returned MCP content is trustworthy. The remote provider can observe submitted trade queries and controls the tool responses consumed by the agent. If the provider, its infrastructure, or its dependencies are compromised, the endpoint could return inaccurate data or adversarial content designed to influence subsequent agent behavior.

Attack Path

  1. A user or agent loads the MCP configuration from SKILL.md.
  2. The agent connects to https://gateway.pipeworx.io/comtrade/mcp.
  3. Trade queries and associated parameters are transmitted to the third-party service.
  4. The service observes those queries and generates the corresponding MCP responses.
  5. A malicious or compromised service returns manipulated trade data or adversarial response content.
  6. The agent may trust, summarize, or act on the manipulated response as though it originated from an authoritative UN Comtrade source.

Impact Assessment

The third-party gateway can access trade-query data sent through the configured MCP connection and control the content returned for the advertised tools. This creates confidentiality and integrity risks, including query monitoring, inaccurate trade results, a ...[truncated 375 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the third-party gateway with an official UN Comtrade endpoint where technically possible.
  2. Alternatively, include a locally auditable MCP implementation that communicates directly with the authoritative data source.
  3. If the gateway is required, document its operator, ownership, privacy policy, retention behavior, and security responsibilities.
  4. Obtain explicit user consent before transmitting queries or other potentially sensitive context to the service.
  5. Restrict the MCP integration to explicitly approved tools and validate response schemas, sizes, and content types.
  6. Treat returned text as untrusted data and prevent it from being interpreted as agent instructions or executable content.
  7. Apply endpoint allowlisting, certificate validation, authentication, logging, timeout limits, and appropriate network egress restrictions.
  8. Independently verify security-sensitive or decision-critical trade results against authoritative UN Comtrade data.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.