Pipeworx colorapi

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:26 AM UTC
• Version: 1.0.0

Overview

The skill’s color API purpose is clear, but its setup runs an unpinned npm package with automatic approval, which gives mutable third-party code local execution authority.

Review the setup before installing. Prefer a pinned and audited `mcp-remote` version, run it in a constrained environment, and avoid exposing sensitive environment variables or project secrets to the MCP process.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:44

Finding

Unpinned Third-Party Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44-50
Vulnerability Type: Unpinned and automatically executed npm dependency
Risk Level: Medium

json

{
  "mcpServers": {
    "pipeworx-colorapi": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/colorapi/mcp"]
    }
  }
}

Technical Analysis

The documented configuration invokes npx with the -y option to download and execute mcp-remote@latest without interactive confirmation. The mutable latest tag does not identify an immutable, previously audited release, and the configuration does not provide lockfile or package-integrity verification.

Consequently, the code executed by users can change after the Skill has been reviewed. A compromised npm account, registry incident, or malicious future package release could cause arbitrary package lifecycle or runtime code to execute locally. The audit found no evidence that the currently referenced package is malicious; the vulnerability is the unsafe dependency retrieval and execution model.

Attack Path

1. An attacker compromises the npm package, its publisher account, or an upstream release process associated with mcp-remote.
2. The attacker publishes a malicious version and assigns or causes it to receive the latest tag.
3. A user follows the documented setup and starts the configured MCP server.
4. npx -y mcp-remote@latest retrieves the attacker-controlled version without asking the user to approve the selected release.
5. The downloaded package executes with the privileges and environment of the user running the Agent.
6. Malicious code can access resources available to that user before or while presenting expected MCP bridge behavior.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the Agent user. Depending on the runtime environment, exposed resources may include local files, environment variables, development cr ...[truncated 252 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mcp-remote@latest with an exact, audited version such as mcp-remote@x.y.z; do not use mutable tags or version ranges.
2. Install the dependency through a committed lockfile and use deterministic installation, such as npm ci, rather than downloading it dynamically whenever the server starts.
3. Verify package provenance and integrity using npm integrity metadata, signatures, or an organization-controlled artifact registry.
4. Review the selected release, including package lifecycle scripts and transitive dependencies, before deployment.
5. Disable or tightly control package installation scripts where operationally possible.
6. Run the MCP bridge in a sandbox or container with a minimal environment, read-only filesystem access where possible, no unnecessary credentials, and network access limited to required endpoints.
7. Establish an explicit update process in which new package versions are reviewed, tested, and pinned before rollout.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

openclaw:
    requires:
      bins:
        - curl
    emoji: "🎨"
    homepage: https://pipeworx.io/packs/colorapi
---

Static analysis

No suspicious patterns detected.