Pipeworx Fintech Analyst

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:57 AM UTC
• Version: 1.0.0

Overview

The skill is a financial-analysis MCP connector, but it routes work through a third-party gateway and recommends saving intermediate findings without explaining storage scope or user controls.

Review before installing if your financial research includes confidential company plans, customer data, personal complaint details, or sensitive investment interests. Use it only for information you are comfortable sending to Pipeworx, and avoid `remember`/`recall` unless the provider documents storage, retention, deletion, and isolation controls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Financial Queries Routed Through an Opaque Third-Party MCP Gateway

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7-11
Vulnerability Type: Third-party service and supply-chain trust risk
Risk Level: Medium

Vulnerable Code:

json

{
  "mcpServers": {
    "fintech-intel": {
      "url": "https://gateway.pipeworx.io/mcp?task=fintech%20analysis"
    }
  }
}

Technical Analysis

The Skill directs the agent to connect to a remote MCP gateway operated at gateway.pipeworx.io instead of directly accessing the official SEC, CFPB, FDIC, Alpha Vantage, or FRED interfaces. This places the external gateway inside the agent's tool trust boundary.

Tool arguments—including financial research queries, company interests, and any context included by the agent—may consequently be visible to the gateway. Tool definitions and responses are also controlled by the remote service and can change independently of the reviewed SKILL.md file. The project provides no authentication requirements, server-integrity controls, schema pinning, privacy policy, retention limits, or instructions to treat returned content as untrusted.

The configuration uses HTTPS, which protects data in transit when certificate validation operates correctly, but it does not establish that the service itself is trustworthy or that its responses accurately represent the named public data sources.

Attack Path

1. A user or agent installs the MCP configuration from SKILL.md.
2. The agent submits a financial-analysis request and associated arguments to gateway.pipeworx.io.
3. The gateway receives the query and may observe any business-sensitive context included in it.
4. A compromised or malicious gateway returns manipulated financial data, misleading text, or adversarial content in a legitimate-looking tool response.
5. If the agent accepts the response without independent validation, the altered content can influence its analysis and downstream recommendations.

Impact Assessment

T ...[truncated 492 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer direct connections to official SEC, CFPB, FDIC, Alpha Vantage, and FRED APIs where practical.
• Clearly disclose that requests transit a third-party service and obtain informed user consent before transmitting sensitive queries.
• Document the gateway's operator, privacy policy, data-retention period, deletion process, subprocessors, and security controls.
• Minimize transmitted context and prohibit sending credentials, personal data, confidential financial information, or unrelated conversation history.
• Require authenticated MCP access and validate TLS certificates without bypasses.
• Pin or validate expected tool names, argument schemas, and response schemas so unexpected server-side changes fail closed.
• Treat every remote response as untrusted data. Do not interpret response text as agent instructions or authorize actions solely from it.
• Cross-check material financial facts against the corresponding official source before presenting conclusions or making consequential recommendations.
• Apply least-privilege controls to the MCP server and restrict it to the minimum tools required for the user's request.

other

Warning

• Location: SKILL.md:57

Finding

Undocumented External Persistence Recommended for Intermediate Findings

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57-61
Vulnerability Type: Unspecified external data persistence
Risk Level: Medium

Vulnerable Code:

markdown

## Tips

- Start with compound tools — they handle errors and combine data automatically
- Use `ask_pipeworx` if you're unsure which tool to use
- Use `remember`/`recall` to save intermediate findings

Technical Analysis

The Skill recommends using remember and recall to save intermediate findings, but these tools are absent from the documented compound-tool and individual-tool inventories. The file does not explain whether saved information remains local, is transmitted to Pipeworx, or persists across users or sessions.

No storage scope, access-control model, encryption policy, retention duration, deletion mechanism, tenant-isolation guarantee, or user-consent requirement is specified. Intermediate financial findings can contain confidential company information, personal data from consumer complaints, or details about a user's research activity. Recommending persistence without defining these boundaries creates a risk of unintended retention and later disclosure.

This finding does not establish that the tools perform malicious memory poisoning. It concerns the undocumented handling and potential external persistence of user-derived information.

Attack Path

1. The agent follows the recommendation to save intermediate findings with remember.
2. Findings are supplied to an undocumented tool whose implementation and storage boundary are not described in the project.
3. If the tool is hosted by the configured remote provider, the information may be retained outside the user's environment.
4. Weak access controls, excessive retention, tenant-isolation failures, account compromise, or provider misuse could expose the stored findings.
5. A later recall operation could also return stale or altered information, which may con ...[truncated 579 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the remember/recall recommendation until the tools and their security behavior are fully documented.
• Explicitly identify whether storage is local or remote and whether data persists across sessions.
• Require affirmative user consent before saving any intermediate finding.
• Define retention periods, deletion procedures, encryption requirements, access controls, tenant isolation, backup handling, and audit logging.
• Provide commands or documented procedures that allow users to inspect and permanently delete saved information.
• Prohibit storage of credentials, personal data, confidential business information, raw consumer complaints, and other sensitive content by default.
• Namespace stored records by authenticated user and task, and prevent retrieval across users or unrelated sessions.
• Attach provenance and timestamps to recalled findings and require revalidation against authoritative sources before consequential use.
• Treat recalled content as untrusted data rather than instructions, policies, or authoritative facts.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.