Pipeworx econdata

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:22 AM UTC
• Version: 1.0.0

Overview

The skill appears to provide economic data access, but its setup auto-runs an unpinned npm MCP bridge, so users should review it before installing.

Install only if you trust Pipeworx and the npm package used to bridge the MCP endpoint. Prefer pinning mcp-remote to a reviewed exact version, preinstalling it through a controlled process, and running it under a least-privilege account. Expect economic query arguments to be sent to the Pipeworx gateway.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:48

Finding

Unpinned Third-Party Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48–49
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

json

{
  "mcpServers": {
    "pipeworx-econdata": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/econdata/mcp"]
    }
  }
}

Technical Analysis

The setup configuration invokes npx with mcp-remote@latest. This causes an unspecified, current release of a third-party npm package to be downloaded and executed. The effective package code can therefore change after the Skill has been audited. The -y option automatically accepts installation prompts, reducing the opportunity for users to inspect or reject an unexpected package version.

No evidence in the reviewed project establishes that the current package is malicious. The vulnerability arises from the absence of an exact version pin, lockfile, or integrity verification, which exposes installation to upstream package or publisher-account compromise and malicious future releases.

Attack Path

1. An attacker compromises the npm publisher account, package publication process, or another relevant part of the mcp-remote supply chain.
2. The attacker publishes a malicious release and causes it to resolve through the npm latest tag.
3. A user configures or starts the Skill using the documented setup.
4. npx -y mcp-remote@latest retrieves the attacker-controlled release without requesting confirmation.
5. npx executes the downloaded package under the account running the Agent.
6. The malicious package can perform operations permitted to that account, such as reading accessible files, making network requests, modifying user-owned data, or launching additional processes.

Impact Assessment

Successful exploitation would permit arbitrary code execution with the privileges of the user or service account running the MCP configuration. The resulting scope depends on that account's pe ...[truncated 411 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mcp-remote@latest with an exact, reviewed version, for example:

   json

   "args": ["-y", "mcp-remote@X.Y.Z", "https://gateway.pipeworx.io/econdata/mcp"]
   

2. Review the pinned release and its transitive dependencies before deployment.
3. Use a lockfile and npm integrity metadata where the deployment model permits, ensuring reproducible dependency resolution.
4. Avoid automatic acceptance with -y in security-sensitive installation workflows, or preinstall the reviewed dependency through a controlled build process.
5. Retrieve packages only from a trusted, explicitly configured registry and apply organizational package allowlisting where available.
6. Run the MCP process under a dedicated least-privilege account or sandbox with restricted filesystem, credential, process, and network access.
7. Establish a controlled update process that reviews, tests, and approves each package upgrade before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

Example: CPI for 2022-2024

bash

curl -s -X POST https://gateway.pipeworx.io/econdata/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_cpi","arguments":{"start_year":"2022","end_year":"2024"}}}'