Ecommerce Product Research

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:34 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed PipiAds ecommerce research integration, with the main caution that it installs a third-party npm MCP server and gives it a PipiAds API key.

Before installing, use a PipiAds API key with the least access and spending exposure available, monitor credit usage, and remember that the globally installed npm MCP server is external code not bundled for review in this skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Unreviewable Globally Installed MCP Dependency Receives an API Credential

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7–18
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml

bins:
  - npm
install:
  command: npm
  args:
    - install
    - -g
    - "pipiads-mcp-server@1.0.3"
primaryEnv: PIPIADS_API_KEY
emoji: "📊"
homepage: https://www.pipiads.com
mcpServers:
  pipiads:
    command: pipiads-mcp-server

The related credential mapping continues on lines 19–20:

yaml

      env:
        PIPIADS_API_KEY: "{{PIPIADS_API_KEY}}"

Technical Analysis

The skill installs pipiads-mcp-server@1.0.3 globally from the npm registry and subsequently executes its binary as an MCP server. The project contains only SKILL.md; it does not include the dependency's source code, lockfile, integrity hash, package provenance, or an independently auditable implementation.

Although the explicit version pin reduces version drift, it does not verify package integrity or prevent compromise of that published version. npm installation may execute package lifecycle scripts with the permissions of the user performing the installation. At runtime, the installed server also receives PIPIADS_API_KEY through its environment.

No evidence in the audited project proves that the named package is malicious. The risk arises because unreviewed third-party installation and execution form a supply-chain trust boundary while exposing a billing-capable API credential.

Attack Path

1. A user or agent enables the skill and runs the declared installation command.
2. npm retrieves pipiads-mcp-server@1.0.3 and its transitive dependencies from the configured registry.
3. Any package lifecycle scripts execute with the invoking user's privileges.
4. The globally installed pipiads-mcp-server binary is launched as an MCP server.
5. The process receives PIPIADS_API_KEY in its environment.
6. If the package, a transitive ...[truncated 954 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an auditable first-party implementation or include the MCP server source in the reviewed project.
2. Verify package ownership, release provenance, signatures, and published integrity before installation.
3. Use a lockfile or equivalent integrity-pinned installation process covering the package and all transitive dependencies.
4. Avoid global installation. Install into a dedicated, non-privileged project environment or isolated container.
5. Disable npm lifecycle scripts during installation where operationally possible, then explicitly allow only reviewed build steps.
6. Run the MCP server under a restricted service account or sandbox with minimal filesystem and network access.
7. Supply a narrowly scoped API key limited to the required operations, account, and spending threshold.
8. Do not expose unrelated environment variables to the server process.
9. Add credential rotation and revocation guidance, audit API usage, and configure alerts or limits for abnormal credit consumption.
10. Document the expected network destinations and enforce an outbound allowlist where possible.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.