Pipeworx pubmed

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:54 AM UTC
• Version: 1.0.0

Overview

This PubMed skill appears purpose-aligned, but it routes biomedical search queries through an under-explained third-party gateway.

Review this before installing if your searches may include personal health details, patient information, unpublished research, or other sensitive biomedical interests. Use only non-sensitive queries unless you are comfortable with gateway.pipeworx.io receiving them, or prefer a direct official NCBI/PubMed workflow if available.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:19

Finding

Undisclosed Third-Party Exposure of Biomedical Search Queries

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–21 and 39–44
Vulnerability Type: Third-Party Data Disclosure
Risk Level: Medium

Complete Code Snippet:

bash

curl -X POST https://gateway.pipeworx.io/pubmed/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search_pubmed","arguments":{"query":"CRISPR cancer therapy","limit":5}}}'

json

{
  "mcpServers": {
    "pubmed": {
      "url": "https://gateway.pipeworx.io/pubmed/mcp"
    }
  }
}

Technical Analysis

The skill is described as providing access to the National Library of Medicine's PubMed database and states that it is powered by NCBI E-utilities. However, both its usage example and MCP client configuration direct requests to gateway.pipeworx.io, an external intermediary rather than an official NCBI endpoint.

Consequently, biomedical search terms are disclosed to that intermediary. Such queries may reveal sensitive medical interests, research activity, or inferred health concerns. The skill provides no information about the gateway's operator, privacy policy, data retention, request logging, response integrity, or operational necessity.

The use of HTTPS protects data in transit from passive network observers, but it does not prevent the gateway itself from reading, retaining, correlating, or modifying requests and responses. The audited file does not establish malicious operation by the gateway; the risk arises from undisclosed third-party processing and the resulting trust boundary.

Attack Path

1. A user adds the supplied pubmed MCP server configuration to an MCP client.
2. The user or agent submits a biomedical literature query through the advertised tool.
3. The client sends the query, request metadata, and associated network metadata to gateway.pipeworx.io.
4. The gateway can observe or retain the query and may correlate it with ...[truncated 682 chars]

Remediation

View remediation

Remediation Suggestions

1. Connect directly to an official NCBI E-utilities endpoint where the client architecture permits it.
2. If the intermediary is required, clearly identify it as a third-party data processor and explain why it is necessary.
3. Publish or link to its privacy policy, ownership information, retention period, logging practices, security controls, and deletion process.
4. Warn users not to submit personally identifiable information, protected health information, unpublished research data, or other sensitive content in search queries.
5. Minimize transmitted metadata and disable request logging by default where operationally possible.
6. Provide a verifiable self-hosted or official-endpoint alternative.
7. Apply response-integrity controls and document how upstream PubMed results are validated against manipulation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

Example: find CRISPR research

bash

curl -X POST https://gateway.pipeworx.io/pubmed/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search_pubmed","arguments":{"query":"CRISPR cancer therapy","limit":5}}}'

Static analysis

No suspicious patterns detected.