T08 · Insecure Dependencies
- Location
SKILL.md:17- Finding
Wikipedia Requests Routed Through an Unverified Third-Party Gateway
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 17–31
Vulnerability Type: Untrusted third-party API dependency
Risk Level: MediumVulnerable Code
bash curl -X POST https://gateway.pipeworx.io/wikipedia/mcp \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_article_summary","arguments":{"title":"Turing machine"}}}'json { "mcpServers": { "wikipedia": { "url": "https://gateway.pipeworx.io/wikipedia/mcp" } } }Technical Analysis
The Skill is presented as an interface for searching and retrieving content from English Wikipedia, but its example and MCP configuration direct all requests to
gateway.pipeworx.io, an intermediary outside the official Wikimedia infrastructure.The remote implementation is not included in the project, so its request processing, data-retention practices, response integrity, and future behavior cannot be audited from this package. TLS protects traffic in transit but does not establish that the endpoint operator is trustworthy. The gateway necessarily receives submitted article titles, search terms, request metadata, and potentially other MCP arguments.
Because the service controls the responses returned to the Agent, it could also modify, omit, or fabricate content while presenting it as Wikipedia-derived information. The externally hosted implementation can change after this Skill has been reviewed without requiring any modification to
SKILL.md.Attack Path
- A user or Agent configures the MCP server using the endpoint documented in
SKILL.md. - The Agent submits Wikipedia searches, article titles, or other tool arguments to
https://gateway.pipeworx.io/wikipedia/mcp. - The third-party gateway receives the query content and associated network metadata.
- A malicious or compromised gateway records the submitted information or returns altered content.
- The Agent may expose the manipulated resp ...[truncated 915 chars]
- A user or Agent configures the MCP server using the endpoint documented in
- Remediation
View remediation
Remediation Suggestions
- Replace the intermediary with an official Wikimedia API endpoint where the required functionality is available.
- If the intermediary is necessary, explicitly identify its operator and document:
- Data transmitted to the service.
- Logging and retention policies.
- Jurisdiction and privacy terms.
- Authentication requirements.
- Expected response provenance.
- Restrict outbound access to a documented allowlist and permit only the operations needed for Wikipedia retrieval.
- Validate returned data against a defined schema, enforce response-size limits, and treat all returned text as untrusted content rather than Agent instructions.
- Where response integrity is important, verify information against official Wikimedia sources or provide direct official article links.
- Pin or attest the deployed gateway implementation where feasible, monitor endpoint changes, and establish a process for reviewing service updates.
- Warn users not to include credentials, personal data, confidential material, or unrelated sensitive context in queries sent through the gateway.