Pipeworx fruityvice

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:21 AM UTC
• Version: 1.0.0

Overview

The skill appears to provide the advertised fruit nutrition lookup, but its setup runs an unpinned npm package at install/runtime, which gives a mutable dependency local execution authority.

Review before installing. The nutrition-query behavior is coherent, but use a pinned, reviewed `mcp-remote` version or an isolated environment before running the documented MCP setup, especially on machines with sensitive files, tokens, or project credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:50

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 50–54
Vulnerability Type: Unsafe execution of a mutable third-party dependency
Risk Level: High

Vulnerable Code

json

{
  "mcpServers": {
    "pipeworx-fruityvice": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/fruityvice/mcp"]
    }
  }
}

Technical Analysis

The configuration invokes npx with both -y and the mutable package selector mcp-remote@latest. This causes npm to download and execute whichever package version is tagged as latest at invocation time, without interactive confirmation.

Because the effective executable can change after the skill has been reviewed, the audited skill configuration does not uniquely determine the code that will run. If the npm package, maintainer account, publication process, registry response, or a future release is compromised, initialization of the skill can execute attacker-controlled JavaScript with the privileges of the user running the agent.

No evidence establishes that the currently published package is malicious. The vulnerability is the unreviewed, automatically accepted execution of a mutable supply-chain dependency.

Attack Path

1. An attacker compromises the mcp-remote package, a maintainer or publication credential, its release pipeline, or another relevant supply-chain component.
2. The attacker publishes a malicious release and assigns it the npm latest distribution tag.
3. A user initializes the documented MCP server configuration.
4. npx -y mcp-remote@latest retrieves the attacker-controlled release without asking for confirmation.
5. npm executes the package under the agent user's operating-system account.
6. The malicious package can access resources available to that account and may perform arbitrary local actions before or while presenting expected MCP behavior.

Impact Assessment

Successful ...[truncated 569 chars]

Remediation

View remediation

Remediation Suggestions

• Replace mcp-remote@latest with an exact, reviewed version such as mcp-remote@x.y.z.
• Record dependency integrity information in a committed lockfile and install with a reproducible command such as npm ci.
• Avoid npx -y for runtime acquisition of executable packages. Prefer installing the audited dependency during a controlled setup phase and invoking the pinned local binary.
• Verify the package's publisher, provenance, release signatures where available, and npm integrity metadata before adoption.
• Use automated dependency monitoring to review updates explicitly rather than following the mutable latest tag.
• Run the MCP bridge with least privilege in an isolated environment that restricts filesystem access, credentials, subprocess execution, and outbound network access to what the nutrition-query function requires.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

openclaw:
    requires:
      bins:
        - curl
    emoji: "🍎"
    homepage: https://pipeworx.io/packs/fruityvice
---

Static analysis

No suspicious patterns detected.