Pipeworx genderize

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:39 AM UTC
• Version: 1.0.0

Overview

The skill’s core behavior is disclosed, but it sends personal-name data to a third-party service and uses an unpinned npm bridge that can execute mutable code during setup.

Review before installing. Use this only if you are comfortable sending first names and optional country codes to the Pipeworx genderize endpoint, and avoid regulated, customer, or employee data unless your organization has approved that processing. Prefer pinning `mcp-remote` to a reviewed exact version or running it in a restricted environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:50

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 50-59
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code

json

{
  "mcpServers": {
    "pipeworx-genderize": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/genderize/mcp"]
    }
  }
}

Technical Analysis

The setup configuration invokes npx with the -y option and the mutable dependency specifier mcp-remote@latest. The -y option suppresses installation confirmation, while @latest resolves to whichever package version currently carries the npm registry's latest distribution tag.

Consequently, the code executed during installation is not cryptographically or immutably tied to the version reviewed during this audit. npm packages can execute code through package lifecycle scripts and through the requested command itself. A compromised publisher account, malicious package release, altered distribution tag, or registry compromise could therefore cause future installations to execute attacker-controlled code.

Attack Path

1. An attacker compromises the mcp-remote package publisher, its release pipeline, or the relevant npm registry metadata.
2. The attacker publishes a malicious package version and assigns it the latest distribution tag.
3. A user applies the documented configuration and starts the MCP server.
4. npx -y mcp-remote@latest retrieves the attacker-controlled version without requesting confirmation.
5. Malicious lifecycle or runtime code executes with the privileges and environment of the user running the Agent.

Impact Assessment

Successful exploitation can provide arbitrary code execution under the Agent user's account. Depending on that account's permissions and environment, the malicious dependency could read or modify accessible project files, configuration, credentials, environment variables, and user data; ini ...[truncated 273 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mcp-remote@latest with an exact, reviewed version, such as mcp-remote@x.y.z; do not use a range or mutable distribution tag.
2. Use a lockfile and enforce integrity verification through npm lockfile hashes or an equivalent reproducible dependency mechanism.
3. Install the dependency through a controlled deployment process rather than downloading it automatically each time the MCP server starts.
4. Disable or strictly control npm lifecycle scripts where operationally possible, and review the package's transitive dependencies before approval.
5. Configure an approved registry and package allowlist, monitor package ownership and release changes, and require security review before version upgrades.
6. Run the MCP process in a least-privilege sandbox with restricted filesystem, credential, environment-variable, and network access to reduce the impact of a compromised dependency.
7. Document the pinned version and upgrade procedure so updates are deliberate, tested, and auditable.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 79% confidence

Finding

The skill is explicitly configured to use curl and a remote HTTPS endpoint, which means user-supplied names are transmitted outside the local environment to a third-party service. In this skill's context, that behavior is expected functionality, but it still creates a real data-exposure risk because the transmitted data may be personal data and the documentation does not clearly disclose handling, retention, or privacy implications.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

openclaw:
    requires:
      bins:
        - curl
    emoji: "👥"
    homepage: https://pipeworx.io/packs/genderize
---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill performs privacy-sensitive demographic inference from a person's first name and sends that name to an external service, but the documentation does not warn users about either the sensitivity of the inference or the data transfer. This can lead users to process personal data without informed consent, appropriate notice, or compliance review, especially in regulated or enterprise contexts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.