Pipeworx boardgames

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:03 AM UTC
• Version: 1.0.0

Overview

This skill is a simple board-game lookup MCP integration, with the main caveat that searches go to a third-party remote service.

Install this only if you are comfortable sending board-game search terms and game IDs to the configured Pipeworx gateway. Treat returned game descriptions and metadata as remote content, and prefer a client that limits the server to the documented board-game tools.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unaudited Third-Party MCP Service Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–23
Vulnerability Type: Unverified remote MCP dependency
Risk Level: Medium

The skill delegates its functionality to a remotely operated MCP endpoint whose implementation is not included in the project:

json

{
  "mcpServers": {
    "boardgames": {
      "url": "https://gateway.pipeworx.io/boardgames/mcp"
    }
  }
}

Technical Analysis

The configuration directs the agent to connect to gateway.pipeworx.io, while the documentation describes the skill as a wrapper for the Board Game Atlas API. Because the project contains no local implementation, integrity metadata, pinned server version, authentication guidance, or enforceable tool allowlist, the behavior of the remote service cannot be verified from the reviewed artifact.

The remote operator—or an attacker who compromises the service—could change the MCP tool definitions and responses after this skill has been reviewed, without modifying SKILL.md. Data returned by the service could also contain misleading or instruction-bearing content. This is a supply-chain trust risk rather than evidence that the endpoint is currently malicious.

Attack Path

1. A user or agent loads the MCP configuration from SKILL.md.
2. The agent establishes a connection to https://gateway.pipeworx.io/boardgames/mcp.
3. Board-game queries are transmitted to the third-party gateway.
4. The gateway supplies remotely controlled tool definitions and tool responses.
5. If the gateway is compromised or changes behavior, it can return manipulated content or expose functionality beyond the three documented operations.
6. If the consuming agent fails to constrain tools and treat responses as untrusted data, the manipulated service output may influence subsequent agent actions.

Impact Assessment

The confirmed exposure is disclosure of board-game queries and associated request m ...[truncated 520 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer a bundled, reviewable MCP implementation or a documented official upstream endpoint.
2. Pin the MCP server implementation or protocol version and verify release integrity where the deployment model permits it.
3. Restrict the client to an explicit allowlist containing only search_games, get_game, and hot_games.
4. Apply least privilege so the remote MCP server cannot access local files, credentials, shell execution, memory, or unrelated tools.
5. Treat all tool definitions and responses as untrusted remote data; do not interpret response content as agent instructions.
6. Validate response schemas, enforce size and timeout limits, and reject unexpected tool capabilities or content types.
7. Document that requests pass through gateway.pipeworx.io, including what query and metadata fields are transmitted.
8. Establish monitoring, endpoint ownership verification, and a process for disabling the integration if the service changes unexpectedly.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill declares an external MCP server URL and describes functionality that necessarily sends user queries to a third-party service, but it does not warn users that their inputs and resulting metadata leave the local environment. This creates a transparency and privacy issue because users may provide search terms or IDs assuming the skill is self-contained, when in fact requests are transmitted to an external endpoint.

Content

No source excerpt is available for this finding.