ClawHub
Back to skill

Security audit

Pipeworx flights

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small, disclosed flight-tracking connector, with the main caution being its use of an unpinned npm helper in the MCP setup.

Before installing, consider pinning mcp-remote to a reviewed version instead of using @latest, and run the MCP process with only the network and environment access it needs. The flight queries themselves go to the documented Pipeworx gateway and do not require an API key.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:46
Finding

Automatic Execution of an Unpinned Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 46-52
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

json
{
  "mcpServers": {
    "pipeworx-flights": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/flights/mcp"]
    }
  }
}

Technical Analysis

The documented MCP configuration invokes npx with the -y option to download and execute mcp-remote@latest without interactive confirmation. The mutable latest tag does not pin the dependency to a reviewed version or cryptographic integrity value. Consequently, the code executed by this configuration can change after the Skill has been audited.

This is a supply-chain exposure rather than evidence that the current package is malicious. Exploitation would require compromise or malicious control of the package, its publisher account, the package registry delivery path, or a future release referenced by latest.

Attack Path

  1. An attacker compromises the npm package, its publisher account, or another relevant package-distribution component.
  2. The attacker publishes a malicious version selected by the latest tag.
  3. A user applies the MCP configuration from SKILL.md.
  4. npx -y retrieves the mutable package version and executes it without requesting confirmation.
  5. The malicious package runs with the permissions and environment available to the Agent process.

Impact Assessment

A successfully compromised dependency could execute arbitrary code with the privileges of the user running the Agent. Depending on the runtime environment, this could expose accessible files, environment variables, tokens, MCP traffic, and other credentials; permit modification of user-owned data; or initiate unauthorized network requests. The scope is limited by the operating-system account, sandboxing, filesystem restrictions, environment-variable filtering, and network contr ...[truncated 31 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace mcp-remote@latest with an exact, audited package version.
  • Use a lockfile and verify package integrity through trusted registry metadata or an independently managed checksum.
  • Avoid automatic installation and execution with npx -y in production deployments; install reviewed dependencies through a controlled build process.
  • Record the expected package publisher, source repository, version, and integrity value so deployments can validate provenance.
  • Monitor the dependency for ownership changes, compromised releases, and security advisories.
  • Run the MCP process under a dedicated least-privilege account or sandbox.
  • Restrict filesystem access, remove unnecessary environment variables and credentials, and limit outbound network access to required endpoints.
  • Re-audit the dependency before upgrading to a newer version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

Example: flights over London

bash
curl -s -X POST https://gateway.pipeworx.io/flights/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_flights_in_area","arguments":{"lamin":51.3,"lomin":-0.5,"lamax":51.7,"lomax":0.3}}}'