ClawHub
Back to skill

Security audit

Pipeworx gutendex

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Project Gutenberg search connector, with the main caveat that its MCP setup runs an unpinned npm bridge package.

Install only if you are comfortable sending book search queries to the Pipeworx gateway and running the MCP bridge through npm. For tighter security, pin mcp-remote to a reviewed version or install it through a locked dependency workflow before use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:44
Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44–52
Vulnerability Type: Unsafe execution of a mutable third-party dependency
Risk Level: Medium

Vulnerable Code

json
{
  "mcpServers": {
    "pipeworx-gutendex": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/gutendex/mcp"]
    }
  }
}

Technical Analysis

The MCP configuration invokes npx with the -y option to automatically download and execute mcp-remote@latest. The latest tag is mutable, so the package code executed in the future may differ from the version reviewed when this Skill was published. The configuration also provides no lockfile, exact version, or package-integrity verification.

Because -y suppresses the installation confirmation, activating this configuration can retrieve and run a newly published package release without an explicit opportunity for the user to inspect it. This creates a supply-chain risk if the npm package, maintainer account, publication process, or dependency chain is compromised.

No evidence establishes that the referenced package is currently malicious. The vulnerability is the unsafe dependency acquisition and execution pattern.

Attack Path

  1. An attacker compromises the mcp-remote npm package, a maintainer account, its publication pipeline, or a relevant dependency.
  2. The attacker publishes a malicious release and causes the mutable latest tag to resolve to it.
  3. A user activates the documented MCP configuration.
  4. npx -y retrieves the package without an interactive installation prompt.
  5. The downloaded package executes locally with the permissions of the user running the Agent.
  6. The malicious release can perform arbitrary actions available to that user before or while establishing the remote MCP connection.

Impact Assessment

Successful exploitation could permit arbitrary local code execution with the Agent user's privileges. Depending on the execution ...[truncated 464 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace mcp-remote@latest with an exact, reviewed version, such as mcp-remote@x.y.z.
  2. Verify the selected release and its dependency tree before documenting or deploying it.
  3. Enforce package integrity through a lockfile and integrity hashes in a controlled installation workflow.
  4. Avoid npx -y for security-sensitive setup because it suppresses confirmation before downloading and executing code.
  5. Prefer installing the audited dependency in advance with a frozen lockfile, then execute the known local binary.
  6. Monitor upstream package ownership and releases, and require security review before version updates.
  7. Run the MCP client with least privilege, restricted filesystem access, minimal environment variables, and constrained network access.
  8. Where practical, use a locally reviewed client or a direct HTTPS integration that does not dynamically download executable code.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

Example: search for Shakespeare

bash
curl -s -X POST https://gateway.pipeworx.io/gutendex/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search_books","arguments":{"query":"Shakespeare"}}}'