Pipeworx amplitude

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:58 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Amplitude analytics connector, but it routes potentially sensitive user analytics data through an under-documented third-party MCP gateway.

Review before installing. Use this only if you trust the Pipeworx gateway with the Amplitude projects and user data your credentials can access. Prefer least-privilege credentials, avoid email-based searches unless necessary, and monitor or restrict profile/activity queries involving identifiable users.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Amplitude Analytics and User Data Routed Through an Unverified Third-Party Gateway

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-33
Vulnerability Type: Third-party MCP gateway trust and supply-chain risk
Risk Level: Medium

Evidence

markdown

## amp_user_search

Search for users by ID or property (e.g., email, user_id). Returns matching profiles with properties

## amp_get_user_activity

Get recent event activity timeline for a specific user. Returns events with timestamps, properties, 

```json
{
  "mcpServers": {
    "amplitude": {
      "url": "https://gateway.pipeworx.io/amplitude/mcp"
    }
  }
}

text

### Technical Analysis

The skill offers operations that can process sensitive analytics and user information, including email addresses, user IDs, profile properties, event properties, and activity timelines. However, the configured MCP endpoint is hosted at `gateway.pipeworx.io`, rather than an official Amplitude-controlled domain.

Consequently, requests and responses may pass through a third-party intermediary. The skill provides no information establishing the gateway's ownership, integrity, authentication model, data-retention policy, or authorization boundaries. It also does not provide an option to use a verified first-party Amplitude endpoint.

This creates a supply-chain trust risk: if the gateway is malicious, compromised, or incorrectly configured, it could observe sensitive query parameters and analytics responses, return manipulated data, or expose capabilities beyond those expected by the user. The project contains no executable local code demonstrating direct compromise, so this finding concerns the unverified external component and the sensitive data potentially routed through it.

### Attack Path

1. A user or agent loads the MCP configuration from `SKILL.md`.
2. The agent connects to `https://gateway.pipeworx.io/amplitude/mcp`.
3. The agent invokes `amp_user_search`, `amp_get_user_activity`, or another analytics operation.
4. User
...[truncated 1080 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the gateway with an official, verified Amplitude MCP endpoint where one is available.
2. If the intermediary is required, explicitly document its operator, purpose, security controls, subprocessors, data-retention policy, and applicable privacy terms.
3. Verify the endpoint and server implementation through a trusted publication channel; pin a version or integrity identity where supported.
4. Apply least-privilege authorization so the MCP server can access only the required Amplitude projects, tools, and data fields.
5. Avoid transmitting direct identifiers such as email addresses unless necessary. Prefer pseudonymous user IDs and minimize returned profile and event properties.
6. Require explicit user approval before searches or activity queries involving personally identifiable information.
7. Use short-lived credentials, enforce credential rotation, and monitor access logs for unusual queries or bulk extraction.
8. Validate MCP tool definitions and responses rather than implicitly trusting behavior supplied by the remote endpoint.
9. Establish contractual and technical controls for encryption, data deletion, incident notification, and restrictions on secondary use of analytics data.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill exposes capabilities to search user profiles and retrieve user activity, but the description does not clearly warn that it can access potentially sensitive analytics data such as emails, identifiers, properties, and behavior history. This can mislead users or downstream agents into invoking the skill without informed consent or appropriate data-handling precautions, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.