Pipeworx patents

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:51 AM UTC
• Version: 1.0.0

Overview

This patent-search MCP is clearly described, but its setup runs a mutable npm package at install/runtime, so users should review the supply-chain risk before installing.

Install only if you are comfortable running `mcp-remote` from npm and sending patent queries through Pipeworx's gateway. Prefer a pinned, reviewed `mcp-remote` version or a controlled installation path before using this in an environment with sensitive files, credentials, or private research queries.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:23

Finding

Unpinned Runtime Dependency Allows Mutable Code Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-27
Vulnerability Type: Unpinned third-party runtime dependency
Risk Level: High

json

{
  "mcpServers": {
    "pipeworx-patents": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/patents/mcp"]
    }
  }
}

Technical Analysis

The configuration invokes npx with the -y option and the mutable package specifier mcp-remote@latest. This automatically downloads and executes whichever package release the npm registry identifies as latest at invocation time, without interactive confirmation.

Consequently, the code executed by this Skill can change after review without any corresponding modification to the repository. A compromised package version, npm publisher account, package release pipeline, or dependency chain could introduce arbitrary installation-time or runtime behavior. No malicious payload is present in the reviewed file itself; exploitation depends on the external package or its supply chain becoming malicious.

The configuration also directs MCP communications to the external endpoint https://gateway.pipeworx.io/patents/mcp. This endpoint is explicitly disclosed, but its use means patent queries and associated MCP traffic are handled by a third-party intermediary.

Attack Path

1. An attacker compromises the mcp-remote npm package, its publisher account, release pipeline, or a dependency included in a newly published release.
2. The malicious release becomes the version resolved by the latest tag.
3. A user installs or invokes the documented MCP configuration.
4. npx -y retrieves the attacker-controlled release without prompting for approval.
5. npm installation hooks or package runtime code execute locally under the account running the Agent.
6. The malicious code can access resources available to that account and perform actions within its operating-system per ...[truncated 718 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mcp-remote@latest with an exact, reviewed version such as mcp-remote@x.y.z; do not use tags or version ranges in executable configuration.
2. Install the dependency through a controlled deployment process rather than downloading and executing it dynamically with npx -y.
3. Commit and enforce a lockfile for the package and its transitive dependencies.
4. Verify registry integrity metadata or cryptographic hashes before installation and execution.
5. Disable or tightly control dependency lifecycle scripts where operationally possible.
6. Monitor package ownership, release provenance, and unexpected dependency changes before approving upgrades.
7. Run the MCP client with least privilege in a sandbox or container, restrict filesystem access, minimize exposed environment variables, and apply outbound network allowlisting.
8. Review the privacy and trust properties of the Pipeworx gateway before sending potentially sensitive queries through it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: pipeworx-patents
description: Patents MCP — wraps PatentsView API (https://api.patentsview.org/)
version: 1.0.0
metadata:
  openclaw:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

---
name: pipeworx-patents
description: Patents MCP — wraps PatentsView API (https://api.patentsview.org/)
version: 1.0.0
metadata:
  openclaw:

Static analysis

No suspicious patterns detected.