Pipeworx ukpolice

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:08 AM UTC
• Version: 1.0.0

Overview

The skill clearly describes a UK police-data MCP integration, but its install example runs an unpinned npm package automatically, which gives mutable third-party code local execution authority.

Review this before installing. The police-data functionality is coherent, but the MCP config should ideally pin `mcp-remote` to a reviewed exact version or run in a restricted environment with minimal filesystem, environment-variable, and credential access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:45

Finding

Unpinned npm Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45–52
Vulnerability Type: Unpinned third-party dependency executed through npx
Risk Level: Medium

Vulnerable Code

json

{
  "mcpServers": {
    "pipeworx-ukpolice": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/ukpolice/mcp"]
    }
  }
}

Technical Analysis

The MCP configuration invokes npx with the -y option and the mutable package reference mcp-remote@latest. This causes npm to retrieve and execute the package automatically without interactive confirmation, an exact version constraint, an integrity check, or a reviewed lockfile.

Because the latest tag can be reassigned to a different package release after this Skill has been reviewed, the code ultimately executed is not fixed by the audited project. A compromised package release, npm maintainer account, publishing token, or upstream dependency could therefore introduce attacker-controlled code into subsequent executions.

Attack Path

1. An attacker compromises the mcp-remote package, a maintainer account, a publishing credential, or an upstream dependency used by a new release.
2. A malicious release becomes the target of the npm latest tag.
3. A user starts the configured pipeworx-ukpolice MCP server.
4. npx -y retrieves the current mcp-remote@latest package without requesting confirmation.
5. npm executes the downloaded package locally.
6. Malicious package code runs with the operating-system permissions and environmental access of the user or Agent process.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the account launching the MCP server. Depending on that account's permissions and environment, the malicious package could read or modify accessible files, inspect environment variables and credentials, access Agent or MCP data, make unauthorized network requests, or alter local development resources. ...[truncated 231 chars]

Remediation

View remediation

Remediation Suggestions

• Replace mcp-remote@latest with an exact, reviewed version such as mcp-remote@x.y.z.
• Manage the dependency through a committed package manifest and lockfile rather than downloading a mutable release at runtime.
• Verify the resolved package and transitive dependencies with package-manager integrity metadata.
• Review the pinned package version and its dependency tree before deployment.
• Disable automatic confirmation where practical so unexpected installation behavior is visible to the operator.
• Use a restricted runtime account or sandbox with minimal filesystem, credential, and network access.
• Establish a controlled dependency-update process that reviews and tests each version before changing the pin.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

Example: crimes near Westminster in January 2024

bash

curl -s -X POST https://gateway.pipeworx.io/ukpolice/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_crimes","arguments":{"lat":51.5007,"lng":-0.1246,"month":"2024-01"}}}'

Static analysis

No suspicious patterns detected.