ClawHub
Back to skill

Security audit

Pipeworx exchange

Security checks for vulnerabilities and agentic risk

Overview

This currency conversion skill is mostly coherent, but its setup runs a mutable npm package automatically, which deserves review before installation.

Review the MCP setup before installing. Prefer a pinned version of `mcp-remote`, run it with minimal environment variables and filesystem access, and be aware that exchange queries are sent to the Pipeworx gateway.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:56
Finding

Unpinned Third-Party Package Is Automatically Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 56–61
Vulnerability Type: Unpinned and automatically executed third-party dependency
Risk Level: Medium

Vulnerable Code

json
{
  "mcpServers": {
    "pipeworx-exchange": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/exchange/mcp"]
    }
  }
}

Technical Analysis

The MCP client configuration invokes npx with the -y option and the mutable package specifier mcp-remote@latest. When this configuration is used, npx may automatically download and execute whichever package release is identified as latest at that time.

Because the package version and integrity are not pinned, the code executed by users can change after the Skill has been reviewed. The -y option also suppresses the normal installation confirmation, reducing the opportunity for users to inspect the dependency before execution.

An attacker who compromises the package, its publishing account, or its upstream release process could distribute a malicious version under the latest tag. This finding does not establish that the current package is malicious; it identifies an unsafe dependency execution pattern.

Attack Path

  1. An attacker compromises the mcp-remote package, its registry publishing account, or the associated release pipeline.
  2. The attacker publishes a malicious package version and assigns it the latest distribution tag.
  3. A user starts the documented MCP server configuration.
  4. npx -y retrieves the attacker-controlled release without interactive confirmation.
  5. The downloaded package executes locally with the permissions and environment of the user running the MCP client.
  6. The payload can perform actions available to that user, including reading accessible files, modifying user-owned data, initiating network connections, or accessing environment variables and credentials available to the process.

Impact Assessment

Success ...[truncated 604 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace mcp-remote@latest with an exact, reviewed version, such as mcp-remote@x.y.z.
  2. Use a lockfile and package-manager integrity metadata to ensure that the resolved artifact cannot change unexpectedly.
  3. Prefer installing the dependency through a controlled build or deployment process instead of downloading it dynamically whenever the MCP server starts.
  4. Remove -y where practical so unexpected package installation requires explicit approval.
  5. Verify the package provenance, maintainer identity, release signatures, and registry integrity before deployment.
  6. Consider vendoring the reviewed dependency or using an internal package registry containing approved artifacts.
  7. Run the MCP process in a sandbox or container with minimal filesystem access, restricted environment variables, limited network access, and no administrative privileges.
  8. Establish dependency monitoring and periodically review pinned versions before applying updates.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

Example: convert 1000 EUR to GBP

bash
curl -s -X POST https://gateway.pipeworx.io/exchange/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"convert","arguments":{"from":"EUR","to":"GBP","amount":1000}}}'

Static analysis

No suspicious patterns detected.