Pipeworx bible

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:13 AM UTC
• Version: 1.0.0

Overview

The skill’s Bible-lookup purpose is coherent, but its setup runs an unpinned npm package at startup, which gives more local execution authority than the simple API task needs.

Review this before installing. The Bible lookup behavior itself is understandable, but prefer a version that pins mcp-remote to a specific reviewed version or uses a controlled install with least-privilege sandboxing and minimal environment access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:45

Finding

Unpinned npm Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:45-52
Vulnerability Type: Unpinned remote dependency execution
Risk Level: High

json

{
  "mcpServers": {
    "pipeworx-bible": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/bible/mcp"]
    }
  }
}

Technical Analysis

The MCP configuration invokes npx with both the automatic-confirmation option (-y) and the mutable package version mcp-remote@latest. When this configuration is started, npm may download and execute the package selected by the current latest distribution tag without interactive approval.

Because latest can be changed after the Skill has been reviewed, the code ultimately executed is not fixed to the audited artifact. A malicious package release, compromised npm publisher account, or compromised upstream release process could therefore replace the expected implementation with attacker-controlled code.

Although the configuration also contacts https://gateway.pipeworx.io/bible/mcp, the confirmed vulnerability is the unsafe execution of a mutable npm dependency. The audited project contains no local scripts demonstrating an additional malicious payload.

Attack Path

1. An attacker compromises the mcp-remote npm publisher account, package release process, or another component capable of changing the package's latest release.
2. The attacker publishes a malicious version and assigns it to the latest distribution tag.
3. A user starts the documented pipeworx-bible MCP configuration.
4. npx -y retrieves the attacker-controlled package without requesting confirmation.
5. The malicious package executes with the permissions and environment of the user running the Agent or MCP client.
6. The payload can access or modify resources available to that user, subject to operating-system controls and any sandbox applied by the host.

Impact Assessment

Success ...[truncated 573 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mcp-remote@latest with a specific, reviewed version, such as mcp-remote@x.y.z.
2. Install the dependency through a controlled package-management workflow that uses a committed lockfile and verifies npm integrity hashes.
3. Remove -y where practical so unexpected package installation requires explicit approval.
4. Prefer a locally installed, verified executable over downloading code at MCP startup.
5. Review package provenance, publisher controls, release signatures, dependency composition, and security history before approving upgrades.
6. Test and approve dependency updates through a change-control process rather than following the mutable latest tag.
7. Run the MCP process with least privilege, a minimal environment, restricted filesystem access, and network access limited to required endpoints.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

openclaw:
    requires:
      bins:
        - curl
    emoji: "📖"
    homepage: https://pipeworx.io/packs/bible
---