Pipeworx Analyst

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:59 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent remote data gateway, but it asks users to send broad questions and persistent context to an external service without enough privacy, scoping, or retention detail.

Review this carefully before installing. Use task-scoped gateway URLs where possible, avoid sending secrets, regulated personal data, credentials, or confidential business information, and do not use remember/recall for sensitive findings unless Pipeworx separately documents retention, deletion, isolation, and access controls you are comfortable with.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unrestricted Reliance on an Externally Controlled MCP Gateway

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5-14
Vulnerability Type: Third-party service and supply-chain trust risk
Risk Level: Medium

Code Snippet:

json

## Setup

{
  "mcpServers": {
    "pipeworx": {
      "url": "https://gateway.pipeworx.io/mcp"
    }
  }
}

Technical Analysis

The skill instructs users to connect an AI agent directly to a remotely controlled MCP gateway. The associated documentation states that this gateway selects the API and supplies arguments on behalf of the agent, but it does not define a fixed tool allowlist, version pinning, authentication requirements, data classification rules, or approval boundaries for sensitive operations.

The effective tool catalog and behavior can therefore change independently of the reviewed SKILL.md file. If the remote service, its upstream APIs, or its deployment infrastructure is compromised, the gateway could return misleading data, expose newly introduced tools, or request operations outside the user's expected scope. This finding does not establish that the current gateway is malicious or that it can execute local code; it identifies the unrestricted trust placed in a mutable third-party component.

Attack Path

1. A user loads the skill and configures the MCP endpoint specified in SKILL.md.
2. The user submits a question that may contain business, financial, medical, property, or other sensitive information.
3. The agent sends the request and relevant arguments to the external gateway.
4. The gateway dynamically selects an API or tool rather than using a locally reviewed, pinned tool implementation.
5. If the gateway or an upstream integration is compromised or behaves unexpectedly, it can return manipulated information or expose functionality beyond the user's intended scope.
6. The agent or user may rely on the manipulated response for subsequent decisions or disclose additional information through fo ...[truncated 535 chars]

Remediation

View remediation

Remediation Suggestions

• Define and enforce an explicit allowlist of approved tools and data sources.
• Pin gateway or tool API versions where the service supports versioning.
• Require user confirmation before invoking tools that transmit sensitive information or perform consequential actions.
• Document what prompt, context, identity, and telemetry data is transmitted to the service.
• Specify authentication, credential scoping, encryption, retention, and incident-response requirements.
• Apply least-privilege credentials with separate scopes for read-only and state-changing operations.
• Validate tool schemas and responses rather than automatically trusting newly introduced remote capabilities.
• Provide guidance for independently verifying financial, medical, legal, or other high-impact results.
• Establish a review process for gateway configuration changes and third-party integrations.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:34

Finding

Persistent Remote Context Is Recommended Without Data-Handling Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34-36
Vulnerability Type: Uncontrolled persistence of potentially sensitive agent context
Risk Level: Medium

Code Snippet:

markdown

### Remember context

Use `remember` and `recall` to save findings across tool calls.

Technical Analysis

The skill recommends using remember and recall to persist findings across tool calls, but it does not identify where the data is stored or specify tenant isolation, access controls, retention periods, encryption, deletion procedures, or restrictions on storing credentials and personal information.

Because the memory functionality is exposed through the external gateway, information saved through remember may leave the immediate agent session. Without documented session and tenant boundaries, sensitive findings could remain available longer than intended or be returned in an inappropriate later context.

This is not evidence that the skill writes attacker-controlled behavioral instructions into agent memory, so it is not classified as Agent Memory Poisoning. The confirmed issue is the insecure and underspecified handling of persistent data.

Attack Path

1. The agent obtains sensitive findings during research, such as financial, medical, corporate, or property-related information.
2. Following the skill documentation, the agent submits those findings to the remote remember tool.
3. The external service persists the content under storage and retention controls that are not described by the skill.
4. The data remains available across later tool calls.
5. Weak account separation, session confusion, compromised credentials, or unintended recall parameters could expose the stored information in a later context.

Impact Assessment

The affected scope consists of any findings supplied to remember, potentially including personal data, confidential research, proprietary business information, or ...[truncated 344 chars]

Remediation

View remediation

Remediation Suggestions

• Disable persistent memory by default and require explicit user consent before storing content.
• Clearly document the storage provider, geographic location, retention period, encryption, and deletion behavior.
• Prohibit storage of credentials, authentication tokens, personal data, regulated records, and proprietary information.
• Enforce strict per-user, per-tenant, and per-session isolation.
• Authenticate and authorize every remember and recall operation.
• Provide listing, expiration, and irreversible deletion operations for stored entries.
• Apply automatic expiration and minimize retained content to the least amount required.
• Redact secrets and sensitive fields before sending content to the persistence service.
• Log memory access securely and alert users to unusual recall or cross-session activity.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description emphasizes convenience and broad connectivity to hundreds of data sources and tools, but it does not warn users that their prompts will be transmitted to an external gateway and potentially multiple downstream providers. This omission can cause users to disclose confidential, personal, or regulated information under the mistaken assumption that the interaction is local or limited in scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill invites users to 'ask anything' in plain English and states that the gateway will choose the right API automatically. That broad, ambiguous invocation model increases the chance that sensitive, regulated, or unexpected user queries are sent to a remote third-party service without clear user awareness or scope limits, creating data leakage and unintended-action risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.