Pipeworx emojihub

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:25 AM UTC
• Version: 1.0.0

Overview

The skill is a simple emoji lookup integration, but its setup runs an unpinned npm package automatically, so users should review the install path before enabling it.

Install only if you are comfortable with the Pipeworx remote service and with npx executing mcp-remote from npm. Prefer a pinned mcp-remote version, run it with minimal filesystem and environment access, and avoid exposing credentials or private workspace data to the MCP process.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:47

Finding

Automatic Execution of an Unpinned npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 47
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable Code

json

{
  "mcpServers": {
    "pipeworx-emojihub": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/emojihub/mcp"]
    }
  }
}

Technical Analysis

The setup directs npx to download and execute mcp-remote@latest. The latest tag is mutable and does not identify a specific, previously audited package artifact. The -y option suppresses the normal installation confirmation, allowing the resolved package to be installed and executed automatically.

Consequently, the code that runs can change after this Skill has been reviewed. A compromised npm account, malicious package update, registry compromise, or other supply-chain incident could cause a future invocation to execute attacker-controlled package code. No evidence establishes that the package is currently malicious; the vulnerability is the unsafe dependency acquisition and execution mechanism.

Attack Path

1. An attacker compromises the package maintainer, publishing workflow, or relevant npm registry distribution path.
2. The attacker publishes a malicious mcp-remote release and assigns it the latest distribution tag.
3. A user configures or starts the Skill using the documented setup.
4. npx -y resolves mcp-remote@latest, downloads the new package without interactive approval, and invokes its executable.
5. Malicious package lifecycle or runtime code executes in the local user's security context.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user or Agent process running npx. Subject to operating-system permissions and sandboxing, this could expose accessible files, environment variables, Agent configuration, and credentials; permit outbound netw ...[truncated 270 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mcp-remote@latest with an exact, audited version, such as mcp-remote@x.y.z.
2. Verify the selected release and retain a lockfile or integrity hash so the installed artifact cannot change silently.
3. Remove automatic confirmation through -y where practical, particularly during initial installation or dependency updates.
4. Obtain dependencies from a controlled registry or vetted internal mirror and monitor the package for ownership and release changes.
5. Run the MCP process in a restricted environment with minimal filesystem access, sanitized environment variables, limited credentials, and constrained outbound networking.
6. Review and test dependency updates before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

openclaw:
    requires:
      bins:
        - curl
    emoji: "😀"
    homepage: https://pipeworx.io/packs/emojihub
---

Static analysis

No suspicious patterns detected.