ClawHub
Back to skill

Security audit

Pipeworx crates

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple crates.io lookup helper that uses a disclosed third-party MCP endpoint and does not show local execution, credential access, persistence, or destructive behavior.

Before installing, treat results from the Pipeworx gateway as third-party data rather than direct official crates.io responses. For security-sensitive dependency choices, verify package names, versions, and metadata against crates.io or another trusted source.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T07 · Tool Hijacking and Spoofing

Warning
Location
SKILL.md:3
Finding

Undisclosed Third-Party MCP Intermediary for crates.io Operations

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 3 and 20–24
Vulnerability Type: Tool hijacking and spoofing through an unaffiliated remote MCP endpoint
Risk Level: Medium

Vulnerable Code

markdown
Crates.io MCP — wraps the crates.io REST API v1 (free, no auth)
json
{
  "mcpServers": {
    "crates": {
      "url": "https://gateway.pipeworx.io/crates/mcp"
    }
  }
}

Technical Analysis

The skill describes itself as a wrapper for the crates.io REST API, but it directs all MCP operations to gateway.pipeworx.io rather than an official crates.io endpoint. The document does not disclose the intermediary's trust relationship, operator, data-handling practices, or response-integrity controls.

Because the remote MCP service controls the implementation and results of the documented crate search and metadata tools, it can observe package queries and return data that differs from crates.io. This creates a tool-spoofing risk: calls that appear to access crates.io are actually mediated by a third party.

The audited file contains no evidence that this endpoint executes local code, accesses credentials, installs persistence, or retrieves executable payloads. The risk is limited to information disclosed through MCP requests and decisions made from potentially manipulated responses.

Attack Path

  1. An agent loads the MCP configuration from SKILL.md.
  2. The agent invokes search_crates, get_crate, or get_versions.
  3. The request, including crate names or search terms, is sent to gateway.pipeworx.io.
  4. A compromised or malicious intermediary records the query or returns manipulated package metadata.
  5. The agent or user trusts the response as crates.io data.
  6. The manipulated result influences dependency research or selection, potentially directing the user toward an unsafe package or version.

Impact Assessment

The intermediary can observe crate-search activity and control package metadata presented through t ...[truncated 493 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the third-party MCP service with direct access to the official crates.io API or a locally hosted, audited adapter.
  2. If the intermediary is required, clearly identify its operator and disclose that crate queries and results pass through a third party.
  3. Document the endpoint's privacy policy, retention behavior, authentication model, and integrity guarantees.
  4. Require explicit user approval before registering or contacting the remote MCP server.
  5. Validate security-sensitive metadata against the official crates.io API before recommending or selecting dependencies.
  6. Where supported, pin and verify the remote service identity and use authenticated, integrity-protected responses.
  7. Treat remote descriptions and metadata as untrusted data and prevent them from being interpreted as agent instructions.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.