ClawHub
Back to skill

Security audit

Pipeworx pokemon

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple Pokemon MCP connection recipe, with one disclosed supply-chain caution around running an unpinned npm helper.

Before installing, consider pinning `mcp-remote` to a reviewed version and running the MCP process with least-privilege environment access. The skill itself is narrow and Pokemon-focused, but the npm helper is fetched dynamically when used.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:26
Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26-27
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

json
"command": "npx",
"args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/pokemon/mcp"]

Technical Analysis

The documented configuration invokes npx with both the automatic-confirmation option (-y) and the mutable mcp-remote@latest version selector. Consequently, following the instructions can download and execute whichever package release the npm registry currently assigns to the latest tag.

Because neither an exact version nor an integrity digest is specified, the code executed by users may differ from the code that was available when this skill was reviewed. Compromise of the package, its publisher account, or its release process could therefore turn this dependency-installation command into an arbitrary code-execution channel. The reviewed file does not establish that the current package is malicious; the vulnerability is the unsafe, mutable supply-chain trust model.

Attack Path

  1. An attacker compromises the mcp-remote npm package, its publisher credentials, or its release pipeline.
  2. The attacker publishes a malicious release and assigns it to the npm latest distribution tag.
  3. A user follows the skill documentation and starts the configured MCP server.
  4. npx -y retrieves the attacker-controlled release without an interactive package-installation confirmation.
  5. The malicious package executes locally with the permissions and environment available to the user who launched the MCP server.
  6. It may then access user-readable information, modify user-writable resources, or intercept MCP requests and responses.

Impact Assessment

Successful exploitation permits arbitrary code execution under the invoking user's account. The accessible scope can include files, environment variables, credentials, network resources, ...[truncated 325 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace mcp-remote@latest with a reviewed, exact package version; do not use a mutable distribution tag.
  • Manage the dependency through a committed lockfile and require integrity verification for the resolved package.
  • Remove automatic confirmation where practical so unexpected installation or resolution changes are visible to the operator.
  • Verify and document the expected package publisher, source repository, release provenance, and package signature or attestation.
  • Review dependency updates before deployment and use automated supply-chain scanning to detect compromised, deprecated, or unexpectedly changed releases.
  • Run the MCP process in a least-privilege sandbox with restricted filesystem, environment-variable, credential, and network access to limit the impact of a compromised dependency.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep