Pipeworx exchangerate

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:20 AM UTC
• Version: 1.0.0

Overview

The skill appears to provide the advertised exchange-rate service, but its MCP setup runs an automatically downloaded unpinned npm package on the user's machine.

Review before installing. Prefer pinning mcp-remote to a reviewed exact version, avoid automatic -y installation where possible, and run the MCP process with minimal filesystem and credential access. The exchange-rate API behavior itself is straightforward, but the setup command expands trust to the current npm package release and its dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:41

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 41–42
Vulnerability Type: Supply-chain exposure caused by automatic execution of an unpinned dependency
Risk Level: High

json

{
  "mcpServers": {
    "pipeworx-exchangerate": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/exchangerate/mcp"]
    }
  }
}

Technical Analysis

The documented MCP configuration invokes npx with both the automatic-confirmation option (-y) and the mutable package version mcp-remote@latest. When initialized, this command can download and execute whichever package release the npm registry currently resolves as the latest version.

Because the effective dependency is not pinned to a reviewed version, its executable contents can change after this Skill has been audited. Automatic confirmation also removes the opportunity for a user to review the package installation before execution. A compromise of the package, its maintainer account, the publishing process, or the relevant package-distribution infrastructure could therefore turn the documented setup command into a code-execution vector.

Attack Path

1. An attacker compromises the mcp-remote package, a maintainer account, or its release pipeline.
2. The attacker publishes a malicious version that becomes the package resolved by mcp-remote@latest.
3. A user or Agent initializes the MCP server using the configuration in SKILL.md.
4. npx -y retrieves the current package without an interactive confirmation step.
5. The malicious package executes with the permissions and environment of the user running the Agent.
6. The payload can access resources available to that user and potentially communicate extracted information to an external system.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running the MCP configuration. Dependi ...[truncated 510 chars]

Remediation

View remediation

Remediation Suggestions

• Replace mcp-remote@latest with an exact, reviewed version such as mcp-remote@X.Y.Z.
• Remove -y where practical so installation requires explicit user confirmation.
• Install dependencies through a lockfile-controlled workflow and verify package integrity using registry checksums or an equivalent trusted mechanism.
• Review the pinned package and its transitive dependencies before deployment.
• Use an internal package mirror or allowlist for production environments.
• Run the MCP process in a restricted account or sandbox with minimal filesystem, credential, and network access.
• Establish a controlled update process in which new versions are reviewed and tested before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

openclaw:
    requires:
      bins:
        - curl
    emoji: "💵"
    homepage: https://pipeworx.io/packs/exchangerate
---