ClawHub
Back to skill

Security audit

Pipeworx books

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent books lookup integration, but its MCP setup automatically runs a mutable npm package from the latest tag, which creates a review-worthy supply-chain risk.

Install only if you are comfortable with a remote Pipeworx books service and a local npm-based MCP bridge. Prefer pinning mcp-remote to a reviewed exact version, installing it through a controlled package process, and running the MCP server with limited filesystem and environment access.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:59
Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59–62
Vulnerability Type: Unpinned and automatically executed third-party dependency
Risk Level: Medium

json
"pipeworx-books": {
  "command": "npx",
  "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/books/mcp"]
}

Technical Analysis

The documented MCP configuration invokes npx with the -y option, allowing package installation and execution without interactive approval. It also selects mcp-remote@latest, a mutable npm release tag rather than an exact, reviewed version.

Consequently, the code executed on a future invocation may differ from the code that was available when this skill was audited. The downloaded package and its dependency or lifecycle code execute locally with the privileges of the user running the agent. This creates a software supply-chain risk if the package, its publishing account, the npm distribution channel, or one of its dependencies is compromised.

The remote MCP URL is disclosed and is consistent with the skill's stated purpose. The vulnerability arises from automatically retrieving and executing an unpinned npm package, not from evidence that the current package or endpoint is malicious.

Attack Path

  1. An attacker compromises the mcp-remote npm package, its maintainer account, or a transitive dependency.
  2. The attacker publishes a malicious version that becomes the target of the mutable latest tag.
  3. A user applies the MCP configuration documented in SKILL.md.
  4. npx -y mcp-remote@latest downloads the attacker-controlled release without requesting confirmation.
  5. Package installation, lifecycle, or runtime code executes under the agent user's account.
  6. The malicious code can access resources available to that account or tamper with MCP communications.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user ru ...[truncated 430 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace mcp-remote@latest with an exact, reviewed package version.
  • Use a lockfile and verify package integrity with a trusted cryptographic hash.
  • Avoid unattended installation through npx -y; install the approved dependency through a controlled deployment process.
  • Review and lock transitive dependencies before deployment.
  • Disable or strictly control npm lifecycle scripts where operationally possible.
  • Run the MCP server in a sandbox or container with minimal filesystem, environment-variable, and network access.
  • Establish a dependency-update process that requires security review and testing before changing the pinned version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md
openclaw:
    requires:
      bins:
        - curl
    emoji: "📚"
    homepage: https://pipeworx.io/packs/books
---