Pipeworx disease

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:26 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed COVID statistics MCP connector, but its install configuration automatically runs an unpinned npm package, which users should review before installing.

Install only if you are comfortable with the Pipeworx gateway receiving the statistics queries you make, and prefer pinning `mcp-remote` to a reviewed version or running it in a restricted environment before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49

Finding

Automatic Execution of an Unpinned Remote npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49–50
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

json

{
  "mcpServers": {
    "pipeworx-disease": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/disease/mcp"]
    }
  }
}

Technical Analysis

The MCP configuration invokes npx with the mutable dependency specifier mcp-remote@latest. The -y option suppresses the interactive confirmation that would ordinarily occur before npm downloads and executes a package.

Because latest is a mutable npm distribution tag, the code executed by this configuration can change without any modification to the reviewed Skill. No exact version, lockfile, or package-integrity value is provided. Consequently, the effective local executable depends on the package version served by the npm registry at invocation time.

This creates a supply-chain risk if the package, its maintainer account, its publishing credentials, or its dependency graph is compromised. The audit found no evidence that the current package is malicious; the vulnerability is the unsafe, unpinned automatic execution mechanism.

Attack Path

1. An attacker compromises the mcp-remote package, a relevant maintainer or publishing account, or a transitive dependency used by a newly published release.
2. A malicious release becomes the version referenced by the npm latest tag.
3. A user or agent starts the documented MCP server configuration.
4. npx -y downloads the attacker-controlled release without requesting confirmation.
5. npm executes the package locally with the privileges and environment of the agent process.
6. The malicious package can access resources available to that process before establishing, altering, or simulating the expected MCP connection.

Impact Assessment

Successful exploitation would provide code execution with the same operat ...[truncated 634 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mcp-remote@latest with an exact, reviewed version, such as mcp-remote@x.y.z; do not use mutable tags or version ranges.
2. Install the dependency through a controlled project manifest and committed lockfile rather than downloading it dynamically on every launch.
3. Verify package integrity through the package manager's lockfile integrity metadata or an equivalent trusted checksum and provenance mechanism.
4. Remove -y where operationally practical so unexpected package installation is not silently approved.
5. Review the selected package version and its transitive dependencies before deployment, and use automated dependency and provenance scanning.
6. Run the MCP process under a dedicated least-privilege account or sandbox with restricted filesystem, environment-variable, credential, and network access.
7. Establish an explicit update process in which new versions are reviewed, tested, and integrity-pinned before deployment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

Example: Germany's COVID stats

bash

curl -s -X POST https://gateway.pipeworx.io/disease/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_country_stats","arguments":{"country":"germany"}}}'

Static analysis

No suspicious patterns detected.