Pipeworx Govcon Analyst

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:17 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent government-contract research connector, but it relies on a third-party remote MCP service and recommends persistent memory tools without documenting retention or user controls.

Review this before installing if your GovCon research includes confidential bids, customer names, procurement strategy, controlled information, or personal data. Use it only with information you are comfortable sending to Pipeworx, and avoid remember/recall unless you understand the service's retention and deletion policies.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Undocumented External MCP Trust Boundary and Persistent State Tools

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5–11 and 56–58
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable Code

markdown

## Setup

```json
{
  "mcpServers": {
    "govcon-intel": {
      "url": "https://gateway.pipeworx.io/mcp?task=govcon%20analysis"
    }
  }
}

text

```markdown
## Tips

- Start with compound tools — they handle errors and combine data automatically
- Use `ask_pipeworx` if you're unsure which tool to use
- Use `remember`/`recall` to save intermediate findings

Technical Analysis

The Skill directs the agent to connect to a third-party remote MCP gateway at gateway.pipeworx.io. That server dynamically supplies the tools and mediates access to the advertised government-contract data sources.

The instructions also recommend the ask_pipeworx, remember, and recall tools, although these tools are absent from the documented tool inventory. The Skill does not define their permissions, storage location, retention period, isolation boundaries, or data-handling behavior. In particular, remember implies that submitted content may persist outside the current session.

Consequently, use of the Skill grants an external service a broader trust role than a narrowly scoped public-data lookup requires. The repository does not pin the expected MCP tool definitions or otherwise constrain which tools the remote endpoint may expose. This creates a least-privilege concern and a potential external data-persistence boundary.

The audited project contains only SKILL.md; no evidence of local code execution, credential theft, destructive behavior, or an implemented privilege-escalation exploit was found. The risk is limited to information sent to, or functionality dynamically supplied by, the external MCP service.

Attack Path

1. An agent loads the MCP configuration from SKILL.md.
2. The agent co ...[truncated 1346 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer direct integrations with official SAM.gov, USAspending.gov, and SBIR.gov APIs where operationally feasible.
2. Document the identity of the MCP operator, privacy policy, data-retention period, storage region, deletion process, and subprocessors.
3. Remove remember and recall unless persistent remote storage is a documented requirement.
4. Require explicit user consent before sending sensitive information to the external service or storing it across sessions.
5. Clearly warn users not to submit credentials, controlled information, procurement-sensitive data, personal data, or confidential business information.
6. Allowlist the exact MCP tools required for government-contract research and reject tools not present in that list.
7. Pin or verify remote tool schemas where supported so that reviewed functionality cannot silently change.
8. Apply data minimization by sending only fields necessary for each query and redacting sensitive context.
9. Provide a retention-disabled mode and a documented mechanism for deleting previously stored information.
10. Add auditing and user-visible confirmation for every operation that persists data remotely.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.