Pipeworx gbif

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:29 AM UTC
• Version: 1.0.0

Overview

The skill’s GBIF data access is coherent, but its MCP setup auto-runs a mutable npm package, so it should be reviewed before installation.

Install only if you are comfortable with a remote Pipeworx-hosted GBIF integration and local execution of the MCP bridge. Prefer pinning `mcp-remote` to a reviewed exact version, running it in a restricted environment, and avoiding exposure of unnecessary files, credentials, or environment variables to the MCP process.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:51

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51–54
Vulnerability Type: Supply-chain risk caused by automatic execution of a mutable third-party dependency
Risk Level: Medium

json

{
  "mcpServers": {
    "pipeworx-gbif": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/gbif/mcp"]
    }
  }
}

Technical Analysis

The MCP configuration invokes npx with the -y option and identifies the third-party package as mcp-remote@latest. The latest npm tag is mutable and does not identify a specific, previously reviewed release. The -y option suppresses the normal installation confirmation, allowing the selected package version and its transitive dependencies to be downloaded and executed automatically.

Consequently, the code executed by this configuration can change after the skill has been audited without any modification to SKILL.md. If the npm package, a transitive dependency, its publisher account, or the relevant package-distribution infrastructure is compromised, a malicious release could execute during MCP server startup.

Attack Path

1. An attacker compromises the mcp-remote package publication process, a maintainer account, or a transitive dependency.
2. The attacker publishes a malicious release and causes the mutable latest tag to resolve to it.
3. A user or Agent loads the supplied MCP configuration.
4. npx -y mcp-remote@latest resolves and downloads the attacker-controlled release without requesting confirmation.
5. The downloaded package executes locally as the user running the Agent.
6. Malicious package code accesses resources available to that process or performs unauthorized local and network operations.

Impact Assessment

Successful exploitation would provide code execution with the privileges of the account running the MCP process. Depending on the surrounding runtime restrictions, the malicious ...[truncated 313 chars]

Remediation

View remediation

Remediation Suggestions

• Replace mcp-remote@latest with a reviewed, exact package version rather than a mutable distribution tag.
• Use a lockfile and verify package integrity through npm integrity metadata or an equivalent cryptographic verification mechanism.
• Avoid automatic installation during normal skill execution. Install and review the dependency as a controlled deployment step.
• Review and pin transitive dependencies where the deployment model permits.
• Monitor the pinned package and dependencies for security advisories, updating only after review and testing.
• Run the MCP bridge in a sandbox or container with minimal filesystem access, a sanitized environment, no unnecessary credentials, and restricted outbound network access.
• Execute the process under a dedicated, unprivileged account so a compromised package cannot inherit broader user or system permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

openclaw:
    requires:
      bins:
        - curl
    emoji: "🦎"
    homepage: https://pipeworx.io/packs/gbif
---

Static analysis

No suspicious patterns detected.