Pipeworx disify

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:17 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but its setup runs an unpinned remote npm bridge and its email-checking workflow sends addresses to a third-party service without a clear privacy disclosure.

Review this before installing in a sensitive environment. Prefer a pinned, reviewed mcp-remote version or another controlled deployment method, and only submit email addresses or domains you are allowed to share with Pipeworx's service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:54

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 54–55
Vulnerability Type: Supply-chain risk caused by automatic execution of a mutable dependency
Risk Level: Medium

json

"command": "npx",
"args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/disify/mcp"]

Technical Analysis

The recommended MCP configuration invokes npx with the -y option and the mutable package specification mcp-remote@latest. This causes npm to download and execute whichever package version the latest tag references at invocation time, without an interactive confirmation prompt.

Because the resolved implementation can change after this skill has been reviewed, the code that ultimately executes is neither reproducible nor bounded to the audited project content. Compromise of the npm package, its publisher account, the package registry, or a future malicious release could introduce arbitrary executable behavior without requiring any modification to SKILL.md.

The finding is classified as T08: Insecure Dependencies because the direct weakness is unsafe acquisition and execution of an unpinned third-party dependency.

Attack Path

1. An attacker compromises the mcp-remote npm publisher account or otherwise causes a malicious release to become associated with the latest tag.
2. A user installs or starts the skill using the documented MCP configuration.
3. npx -y resolves mcp-remote@latest, automatically downloads the attacker-controlled release, and runs it without confirmation.
4. The malicious package executes under the identity and environment of the user or agent process.
5. It can access resources available to that process and perform actions allowed by its operating-system permissions.

Impact Assessment

Successful exploitation can result in arbitrary code execution with the privileges of the user running the MCP configuration. The attainable scope depends on that user's permissions and may include reading or modifyin ...[truncated 381 chars]

Remediation

View remediation

Remediation Suggestions

• Replace mcp-remote@latest with an exact, reviewed version, such as mcp-remote@x.y.z.
• Use a lockfile and npm integrity metadata so installation fails if the retrieved package does not match the approved artifact.
• Prefer installing dependencies during a controlled build or deployment phase rather than downloading and executing them automatically at skill startup.
• Maintain an approved internal mirror or vendor the reviewed dependency where stronger supply-chain control is required.
• Run the MCP process in a sandbox or restricted service account with minimal filesystem, environment-variable, credential, and network access.
• Establish a dependency-update process that reviews package provenance and release changes before updating the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

openclaw:
    requires:
      bins:
        - curl
    emoji: "📧"
    homepage: https://pipeworx.io/packs/disify
---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly demonstrates sending full email addresses to a third-party remote API for validation, but it does not disclose the privacy implications, data handling expectations, or need for user consent. Because email addresses are personal data in many contexts, this can lead to unintended external sharing of sensitive user information and compliance exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.