Pipeworx airtable

Integrate with Airtable API to list bases, fetch and filter records, get record details, create new records, and retrieve base schemas.

Security Scan

The skill claims to integrate with Airtable but omits how authentication is handled and points to a third-party gateway (gateway.pipeworx.io), creating an unexplained data-flow and credential ambiguity.

Purpose & Capability

The SKILL.md describes listing bases, reading and creating records, and fetching schemas (all Airtable operations) which normally require Airtable API credentials, yet the skill declares no required environment variables or primary credential. The included JSON points to a third-party gateway (https://gateway.pipeworx.io/airtable/mcp) instead of api.airtable.com, which is not explained and is disproportionate to the described purpose.

Instruction Scope

The runtime instructions are minimal and do not specify how to authenticate or where requests are sent beyond a gateway URL. This gives the agent broad discretion to send Airtable data to the external gateway; the SKILL.md does not constrain or document that behavior, nor does it show how user credentials are provided or stored.

Install Mechanism

There is no install spec and no code files (instruction-only). That reduces local persistence and on-disk execution risk, but it also means all behavior is driven by runtime instructions and remote calls.

Credentials

No environment variables or credentials are declared, yet Airtable operations normally require an API key/token. The skill instead references a third-party gateway which may be expected to hold credentials server-side — this is not documented. That opaque credential handling and an unvetted external endpoint are disproportionate and could lead to unintended data exposure.

Persistence & Privilege

always is false and there is no install-time persistence. The skill does not request elevated platform privileges. Autonomous invocation is allowed (platform default) but not by itself a red flag here.

What to consider before installing

Before installing, ask the skill author these questions: (1) How is Airtable authentication handled? If the skill needs your API key, where should you provide it and how is it stored? (2) Why does the skill route requests through https://gateway.pipeworx.io/airtable/mcp instead of calling api.airtable.com directly? What data is logged or retained by that gateway and who operates it? (3) Can you get a version that calls Airtable directly (so you keep keys locally) or see the gateway's privacy/security documentation? If you don't trust the gateway operator, do not provide Airtable credentials and avoid installing. Consider testing in a throwaway Airtable account with limited data first.

Airtable

Airtable MCP Pack — wraps the Airtable REST API v0

airtable_list_records

Fetch records from an Airtable table with optional filtering by formula (e.g., "{Status} = 'Done'").

airtable_get_record

Retrieve a single record by ID from an Airtable table. Returns all field values and record metadata.

airtable_create_record

Add a new record to an Airtable table with specified field values. Returns the created record ID and

airtable_list_bases

List all Airtable bases you have access to. Returns base IDs, names, and workspace info. Use to expl

airtable_get_base_schema

Get the structure of an Airtable base—all tables, field names, field types, and configurations. Use

{
  "mcpServers": {
    "airtable": {
      "url": "https://gateway.pipeworx.io/airtable/mcp"
    }
  }
}