PipiAds Dropshipping Product Research

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:33 AM UTC
• Version: 1.0.6

Overview

This skill is a disclosed PipiAds product-research integration, with the main risk being a global npm-installed MCP dependency that receives your API key.

Install only if you trust the pipiads-mcp-server npm package and the PipiAds account you connect. Use a limited, revocable PIPIADS_API_KEY, monitor API credit usage, and consider running the MCP server in an isolated environment if the account has meaningful spend or sensitive data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unverified Globally Installed MCP Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–20
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml

install:
  command: npm
  args:
    - install
    - -g
    - "pipiads-mcp-server@1.0.3"
primaryEnv: PIPIADS_API_KEY
emoji: "📊"
homepage: https://www.pipiads.com
mcpServers:
  pipiads:
    command: pipiads-mcp-server
    env:
      PIPIADS_API_KEY: "{{PIPIADS_API_KEY}}"

Technical Analysis

The skill directs npm to retrieve pipiads-mcp-server@1.0.3 from the configured package registry, install it globally, and execute its binary with access to PIPIADS_API_KEY.

Pinning an exact version limits unintended version drift, but the project provides no lockfile, package integrity hash, vendored source, signature verification, or other mechanism that would allow the downloaded artifact to be authenticated and audited from this repository. A global npm installation may also run package lifecycle scripts and places files outside the project directory.

This is a supply-chain trust risk rather than proof that the named package is malicious. The reviewed project contains only SKILL.md, so the dependency's implementation and behavior could not be verified locally.

Attack Path

1. An attacker compromises the package publisher, registry account, package distribution infrastructure, or the client-side npm registry configuration.
2. The skill installation invokes npm install -g pipiads-mcp-server@1.0.3.
3. npm downloads the unverified artifact and may execute its installation lifecycle scripts with the installing user's privileges.
4. The globally installed pipiads-mcp-server binary is subsequently launched.
5. The process receives PIPIADS_API_KEY through its environment.
6. Malicious dependency code could read and disclose that credential, misuse the associated API account, or access files and resources available to the ...[truncated 546 chars]

Remediation

View remediation

Remediation Suggestions

1. Vendor and review the MCP server source, or otherwise independently audit the exact package artifact before deployment.
2. Record and verify a trusted registry integrity digest or signature for the approved artifact.
3. Avoid global installation. Install the dependency in an isolated, project-scoped environment with a lockfile and immutable dependency resolution.
4. Disable npm lifecycle scripts during installation where compatible, or explicitly audit every lifecycle script before allowing it to run.
5. Run the MCP server in a sandbox or container under a dedicated, least-privileged account with restricted filesystem and network access.
6. Supply a narrowly scoped, revocable API key and rotate it if dependency compromise is suspected.
7. Pin the registry origin and enforce trusted package provenance in the deployment pipeline.
8. Monitor API usage and establish spending or credit limits to reduce the impact of credential misuse.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.