ClawHub
Back to skill

Security audit

Pipeworx marine

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a marine forecast MCP connector, but its setup runs an unpinned npm package from the network with local user privileges.

Review this before installing. Prefer a pinned, reviewed version of `mcp-remote` or run it in a restricted environment with minimal filesystem and environment-variable access. Avoid sending sensitive locations or unrelated private context through the Pipeworx gateway unless you trust its handling of request data.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:21
Finding

Automatic Execution of an Unpinned Remote npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:21-25
Vulnerability Type: T03: Remote Payload Retrieval and Execution, T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

json
{
  "mcpServers": {
    "pipeworx-marine": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/marine/mcp"]
    }
  }
}

Technical Analysis

The configuration invokes npx with mcp-remote@latest. This causes npm to retrieve and execute whichever package release is associated with the mutable latest tag at invocation time. Consequently, the code executed on a user's system may differ from the code that existed when the Skill was reviewed.

The -y option automatically accepts installation prompts, removing an opportunity for the user to inspect or reject the downloaded package. No exact version, lockfile, package integrity hash, vendored source, or other reproducibility control is supplied.

Attack Path

  1. An attacker compromises the mcp-remote package, its maintainer account, its publishing credentials, or the relevant package-distribution infrastructure.
  2. A malicious release is published and assigned the latest distribution tag.
  3. A user configures or starts the Skill using the documented connection instructions.
  4. npx -y mcp-remote@latest automatically downloads the attacker-controlled release without an interactive confirmation.
  5. The malicious package executes locally under the account and environment used to launch the Agent.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running npx. Depending on that user's permissions and environment, malicious code could read accessible files and environment variables, access Agent data, alter local files, invoke network services, or execute additional commands.

The package invocation does not itself demonstrate t ...[truncated 171 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace mcp-remote@latest with an explicitly audited, exact version such as mcp-remote@x.y.z.
  2. Install the dependency through a project manifest and committed lockfile rather than downloading an unconstrained release at runtime.
  3. Enforce package integrity verification through lockfile integrity metadata, trusted registry configuration, or a verified vendored artifact.
  4. Remove -y where practical so unexpected installation activity is not accepted automatically.
  5. Run the MCP client in a restricted environment with minimal filesystem access, limited environment variables, and constrained network permissions.
  6. Establish a dependency update process in which new versions are reviewed and tested before the pinned version is changed.

other

Note
Location
SKILL.md:3
Finding

Third-Party MCP Gateway Introduces an Insufficiently Disclosed Trust Boundary

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:3-24
Vulnerability Type: other: External MCP gateway trust risk
Risk Level: Low

Relevant Code:

yaml
description: Marine MCP — wraps marine-api.open-meteo.com (free, no auth)
json
{
  "mcpServers": {
    "pipeworx-marine": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/marine/mcp"]
    }
  }
}

Technical Analysis

The Skill describes itself primarily as a wrapper for marine-api.open-meteo.com, but the documented runtime endpoint is the separate third-party domain gateway.pipeworx.io. Requests therefore pass through a Pipeworx-controlled MCP gateway rather than connecting directly to the stated Open-Meteo service.

This gateway forms an additional trust boundary: it can receive submitted query information and controls the MCP tools and responses exposed to the Agent. The project contains only SKILL.md; it does not provide auditable gateway implementation code, response validation rules, a privacy policy, or technical controls demonstrating how submitted data is handled.

Attack Path

  1. A user starts the MCP integration using the documented configuration.
  2. The local mcp-remote process connects to https://gateway.pipeworx.io/marine/mcp.
  3. Marine queries and associated request data are transmitted to the Pipeworx gateway.
  4. The gateway can observe the submitted data and return MCP tool definitions or results.
  5. If the gateway or its infrastructure is compromised or behaves unexpectedly, manipulated responses may be supplied to downstream Agent workflows.

Impact Assessment

The gateway operator can observe information intentionally included in marine-related requests and controls the responses returned by the integration. A compromised gateway could provide false forecast data or otherwise influence decisions that rely on its output.

No credentials, ...[truncated 290 chars]

Remediation
View remediation

Remediation Suggestions

  1. Explicitly state that requests are sent to and processed by the Pipeworx gateway rather than directly by Open-Meteo.
  2. Document what request data the gateway receives, how it is retained, and whether it is shared with other parties.
  3. Prefer a direct connection to the upstream Open-Meteo API when an intermediary is not operationally necessary.
  4. If the gateway is required, publish auditable server implementation details or a clear security and privacy policy.
  5. Restrict the MCP client to the expected gateway host and validate tool identities, schemas, and response types before downstream use.
  6. Avoid including credentials, personal information, precise sensitive locations, or unrelated Agent context in requests.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.