Pipeworx census-trade

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:09 AM UTC
• Version: 1.0.0

Overview

This is a small remote MCP skill for Census trade queries with no local code or persistence, but queries are routed through a third-party Pipeworx endpoint.

Install only if you are comfortable sending Census trade query details to the Pipeworx-hosted MCP service. Avoid including secrets, personal data, or unrelated conversation context in queries, and treat returned trade data as remote service output rather than locally verified Census data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:23

Finding

Undisclosed Third-Party MCP Trust Boundary

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-28
Vulnerability Type: Third-Party MCP Endpoint Trust Risk
Risk Level: Medium

Vulnerable Code

json

{
  "mcpServers": {
    "census-trade": {
      "url": "https://gateway.pipeworx.io/census-trade/mcp"
    }
  }
}

Technical Analysis

The Skill is presented as an interface to US Census Bureau International Trade data, but it directs the Agent to an MCP service hosted on gateway.pipeworx.io, which is not an official US Census Bureau domain. Consequently, queries and associated metadata cross an external trust boundary controlled by a third party.

The Skill does not disclose what information is transmitted, how it is retained, whether authentication is required, or how remote MCP tool definitions and responses are validated. Because the server is remote, its behavior and exposed tool definitions can change after this static Skill has been reviewed.

This finding does not establish that the endpoint is malicious. It identifies an insufficiently documented and unverified third-party trust relationship that may expose request data or allow manipulated MCP content to influence the Agent.

Attack Path

1. An Agent loads the MCP configuration from SKILL.md.
2. The Agent connects to https://gateway.pipeworx.io/census-trade/mcp.
3. A user invokes an import, export, trade-balance, or trend query.
4. Query parameters and relevant connection metadata are transmitted to the third-party service.
5. The service can observe those requests and controls the MCP tool definitions and responses returned to the Agent.
6. If the endpoint or its infrastructure is compromised or operated maliciously, it could return inaccurate data or untrusted MCP content.

Impact Assessment

The third-party operator may gain visibility into submitted trade queries and related request metadata. A compromised or malicious endpoint could manipulate ret ...[truncated 318 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an official US Census Bureau API or an MCP service hosted on an organization-controlled and audited endpoint.
2. Clearly disclose that Pipeworx is a third-party processor and document the data transmitted, retention policy, logging behavior, authentication model, and applicable privacy terms.
3. Require explicit user consent before sending query data to the external endpoint.
4. Restrict transmitted information to the minimum required query parameters and prohibit secrets, credentials, personal data, or unrelated conversation context from being included.
5. Pin or independently validate expected MCP tool names, schemas, and permissions where supported, rejecting unexpected tool-definition changes.
6. Validate and treat all remote responses as untrusted data before presenting them or using them in subsequent Agent actions.
7. Apply network allowlisting, TLS certificate validation, request timeouts, response-size limits, and comprehensive security logging.
8. Provide an auditable local MCP implementation if the remote service cannot offer adequate integrity, privacy, and operational assurances.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.