ClawHub
Back to skill

Security audit

Pipeworx bluesky

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Bluesky gateway integration, but it tells users to send a Bluesky app password to a third-party service in a URL and uses an unpinned npx package in MCP setup.

Review this before installing. Use the unauthenticated public-read tools only if you are comfortable sending requests through Pipeworx. Avoid putting any Bluesky app password in a URL; if you already did, rotate it. Pin and review the MCP helper package instead of running mcp-remote@latest automatically.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:52
Finding

Bluesky Credentials Disclosed to a Third-Party Gateway Through URL Query Parameters

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52-56
Vulnerability Type: Third-party credential disclosure and insecure secret transmission
Risk Level: High

Vulnerable Code:

text
`search_posts` requires Bluesky credentials. Pass them as query parameters on the gateway URL:

https://gateway.pipeworx.io/bluesky/mcp?bsky_handle=you.bsky.social&bsky_app_password=xxxx-xxxx-xxxx

text

Technical Analysis

The Skill instructs users to transmit a Bluesky handle and app password to gateway.pipeworx.io, a third-party service rather than an official Bluesky or AT Protocol endpoint. This gives the gateway access to reusable authentication material.

The app password is also placed in the URL query string. URLs are commonly recorded by HTTP clients, reverse proxies, API gateways, observability systems, server access logs, and error-reporting infrastructure. Consequently, the credential may be retained or exposed beyond the immediate request even when HTTPS protects the connection in transit.

Attack Path

  1. A user follows the documented authentication instructions for search_posts.
  2. The user places their Bluesky handle and app password in the gateway URL.
  3. The complete URL is transmitted to the Pipeworx gateway and may be processed by intermediary infrastructure.
  4. The URL, including the app password, may be retained in gateway, proxy, monitoring, debugging, or client logs.
  5. An operator or attacker with access to any exposed copy can recover the app password.
  6. The recovered credential can be used against the associated Bluesky account within the permissions granted to that app password.

Impact Assessment

Disclosure could permit unauthorized operations against the associated Bluesky account, limited by the privileges and validity of the supplied app password. The exposure scope includes the third-party gateway and any infrastructure that records URL query strings. ...[truncated 126 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not send Bluesky credentials to the Pipeworx gateway.
  • Authenticate directly with official Bluesky or AT Protocol services wherever possible.
  • Never place passwords, tokens, or other secrets in URL query parameters.
  • Store credentials in a protected local secret store or environment-based secret mechanism with restrictive permissions.
  • Send authentication material only through the official endpoint's supported authorization header or protected request-body mechanism.
  • Clearly document the credential recipient, required permissions, retention policy, and revocation procedure.
  • Use a narrowly scoped app password and rotate any credential previously transmitted using the documented URL.
  • Review gateway, proxy, client, and monitoring logs for retained credentials and securely remove exposed values where possible.

T08 · Insecure Dependencies

Error
Location
SKILL.md:60
Finding

Unpinned Remote Package Is Automatically Downloaded and Executed Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60-67
Vulnerability Type: Unsafe dependency retrieval and execution
Risk Level: High

Vulnerable Code:

json
{
  "mcpServers": {
    "pipeworx-bluesky": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/bluesky/mcp"]
    }
  }
}

Technical Analysis

The MCP configuration invokes npx with -y, causing package retrieval and execution without an interactive review step. The dependency is referenced using the mutable latest tag instead of an audited, immutable version.

The effective code executed by this configuration can therefore change after the Skill has been reviewed. If the package, publisher account, registry distribution channel, or a future release is compromised, attacker-controlled installation hooks or runtime code could execute under the privileges of the user running the MCP client.

Attack Path

  1. A user adds the documented MCP server configuration.
  2. The MCP client starts the configured npx command.
  3. npx -y resolves mcp-remote@latest from the package registry without prompting for approval.
  4. The selected package and its transitive dependencies are downloaded.
  5. Package installation hooks or runtime entry points execute locally.
  6. If the resolved release or dependency chain has been compromised, malicious code executes with the MCP client's operating-system privileges.
  7. The malicious code may access files, environment variables, local credentials, and agent data available to that user.

Impact Assessment

Successful supply-chain compromise could result in arbitrary local code execution. The attainable scope is the operating-system access of the account running the MCP client, including readable files, environment secrets, agent configuration, and accessible network services. No privilege escalation beyond that account is established by the ...[truncated 78 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace mcp-remote@latest with an exact, reviewed package version.
  • Verify the package through a lockfile and package-manager integrity hashes.
  • Remove automatic npx -y execution from production or security-sensitive configurations.
  • Install dependencies through a controlled deployment process that supports review and reproducible builds.
  • Audit direct and transitive dependencies before upgrades.
  • Disable package installation scripts unless they are explicitly required and reviewed.
  • Run the MCP client in a sandbox or restricted account with minimal filesystem, environment-variable, credential, and network access.
  • Establish an upgrade process that reviews release changes before changing the pinned version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

Example: reading someone's recent posts

bash
curl -s -X POST https://gateway.pipeworx.io/bluesky/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_posts","arguments":{"handle":"jay.bsky.team","limit":5}}}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation tells users to supply Bluesky credentials in the URL query string. Query parameters are commonly recorded in browser history, shell history, proxy/server logs, monitoring tools, and copied/shared command text, which can expose the app password to unintended parties.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

Embedding bsky_handle and especially bsky_app_password directly in the gateway URL creates unnecessary secret exposure risk across logs, telemetry, clipboard sharing, and terminal history. Because this is documentation for normal usage, it can systematically cause users to leak valid credentials while interacting with a third-party gateway.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.