Pipeworx flood

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:20 AM UTC
• Version: 1.0.0

Overview

This flood forecast skill is purpose-aligned, but its MCP setup automatically runs a mutable npm package, so it should be reviewed before installation.

Review before installing. Prefer pinning `mcp-remote` to a specific reviewed version, run the MCP bridge in a restricted environment with minimal credentials, and avoid submitting sensitive private locations unless you are comfortable sending those coordinates to the Pipeworx gateway and upstream forecast service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:46

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 46–47
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

json

{
  "mcpServers": {
    "pipeworx-flood": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/flood/mcp"]
    }
  }
}

Technical Analysis

The MCP configuration invokes npx with the -y option and the mutable package reference mcp-remote@latest. If the package is not already available locally, npx can retrieve it from the configured npm registry and execute it without interactive confirmation.

The latest tag does not identify an immutable, reviewed release. Its target can change whenever a new package version is published. Consequently, the effective code executed by this configuration may change after the Skill has been audited. The project contains no lockfile, integrity hash, vendored dependency, or other mechanism that constrains the package to reviewed content.

There is no evidence in the audited file that the current mcp-remote package is malicious. The vulnerability arises from the unsafe, mutable dependency execution mechanism and its exposure to package-registry, maintainer-account, or upstream-release compromise.

Attack Path

1. An attacker compromises the npm package maintainer account, the package publication process, or another relevant supply-chain component.
2. The attacker publishes a malicious release and causes the mutable latest tag to resolve to that release.
3. A user starts the MCP server using the configuration in SKILL.md.
4. npx -y mcp-remote@latest downloads the attacker-controlled package without requesting installation confirmation.
5. The package executes locally with the permissions and environment of the user or agent process.
6. The malicious package can access resources available to that process and perform arbitrary actions within those permission boundaries.

Impa

...[truncated 799 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mcp-remote@latest with an exact, reviewed version, for example mcp-remote@x.y.z.
2. Install the dependency through a controlled build or provisioning step rather than allowing npx to download it automatically at runtime.
3. Commit and enforce a package lockfile containing registry integrity metadata.
4. Verify package provenance, maintainer ownership, release signatures, and integrity before upgrading.
5. Use an approved private registry or dependency proxy where feasible.
6. Remove -y so unexpected installation is not silently approved, although this is not a substitute for version and integrity pinning.
7. Run the MCP bridge in a restricted environment with minimal filesystem access, sanitized environment variables, limited credentials, and network access restricted to required endpoints.
8. Establish a deliberate update process in which new versions are reviewed and tested before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This skill depends on network access to external endpoints and includes examples and configuration that send requests to a third-party gateway. External transmission is expected for a forecast API, but it still creates data exposure and supply-chain trust risk because user inputs and results leave the local environment and rely on a remote service outside the user's control.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

openclaw:
    requires:
      bins:
        - curl
    emoji: "🌊"
    homepage: https://pipeworx.io/packs/flood
---

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill clearly instructs users to provide latitude and longitude and describes use of external Pipeworx/Open-Meteo services, but it does not warn that those coordinates will be transmitted off-host over the network. While coordinates are not always highly sensitive, they can reveal user location, assets, or operational sites, so the lack of disclosure creates a privacy and transparency issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.