ClawHub
Back to skill

Security audit

Pipeworx worldbank

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small World Bank data connector that uses a disclosed Pipeworx MCP endpoint, with no local code, persistence, credentials, or file access shown.

Install only if you are comfortable sending country codes, indicator codes, and date ranges to Pipeworx's hosted gateway and relying on it to return accurate World Bank data. Avoid sending confidential research queries through it, and verify important numbers against the official World Bank source.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:28
Finding

Undisclosed Third-Party Gateway for World Bank Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-42
Vulnerability Type: Untrusted third-party service dependency
Risk Level: Medium

The skill represents itself as providing access to World Bank indicators, but directs all tool requests to gateway.pipeworx.io, which is not an official World Bank domain.

bash
curl -X POST https://gateway.pipeworx.io/worldbank/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_gdp","arguments":{"country_code":"IN"}}}'
json
{
  "mcpServers": {
    "worldbank": {
      "url": "https://gateway.pipeworx.io/worldbank/mcp"
    }
  }
}

Technical Analysis

The configured endpoint introduces a third-party service into the data supply chain without disclosing or explaining that trust boundary. Although HTTPS protects data in transit, it does not protect requests or responses from the gateway operator itself or from a compromise of that service.

The gateway can observe countries, indicators, date ranges, and other submitted parameters. It can also return inaccurate, manipulated, or schema-valid but misleading data. No response provenance, integrity verification, endpoint authentication beyond ordinary TLS, or direct comparison against the official World Bank API is documented.

There is no evidence in the audited file that the gateway executes code locally or receives credentials. The identified exposure is limited to the confidentiality of submitted queries and the integrity and availability of returned data.

Attack Path

  1. A user installs the provided MCP configuration.
  2. The MCP client sends World Bank queries to https://gateway.pipeworx.io/worldbank/mcp.
  3. The gateway operator, or an attacker who compromises the gateway, records the submitted query metadata.
  4. The gateway returns manipulated, incomplete, stale, or fabricated indicator values while preserving ...[truncated 816 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the intermediary with the official World Bank API wherever technically possible.
  2. If the gateway is required, explicitly disclose that queries are processed by Pipeworx and document its ownership, privacy policy, retention practices, and security controls.
  3. Restrict accepted responses to a documented schema and validate country codes, indicator codes, date fields, numeric values, and response-size limits.
  4. Verify returned values against the official World Bank source when data integrity is important.
  5. Pin the service to an approved endpoint and enforce HTTPS certificate validation, strict redirect handling, and conservative request timeouts.
  6. Do not send credentials, personal data, confidential research parameters, or other sensitive information through the gateway unless appropriate contractual and technical protections are established.
  7. Document failure behavior so unavailable or unverifiable data is reported as such rather than treated as authoritative.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

Example: India's GDP over the last decade

bash
curl -X POST https://gateway.pipeworx.io/worldbank/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_gdp","arguments":{"country_code":"IN"}}}'

Static analysis

No suspicious patterns detected.