Pipeworx onthisday

On This Day MCP — wraps byabbe.se/on-this-day (free, no auth)

Security Scan

The skill's purpose (wrapping an on-this-day API) is plausible, but the runtime instructions tell the agent to dynamically download and run an npm package (npx mcp-remote@latest) that will contact an external gateway — a design that is coherent but introduces non-trivial risk and opaque behavior.

Purpose & Capability

Name and description (wraps byabbe.se/on-this-day) match the declared tools. The SKILL.md provides a single connection method that proxies to gateway.pipeworx.io, which can be a legitimate implementation detail, though the skill does not document how the gateway maps to the claimed backend.

Instruction Scope

The instructions tell the agent to run an npx command that will fetch and execute code (mcp-remote) and connect to https://gateway.pipeworx.io/onthisday/mcp. The SKILL.md does not describe what mcp-remote does, what data it sends/receives, or what the gateway expects — giving the package broad discretion to run arbitrary code and exchange data with a third-party server.

Install Mechanism

There is no install spec in the registry, but the connect snippet instructs use of npx -y mcp-remote@latest. Fetching @latest at runtime is a dynamic download/execute pattern (npm registry) and therefore a moderate-to-high risk compared with an instruction-only skill or a pinned, audited release.

Credentials

The skill requests no environment variables, credentials, or config paths in the manifest. That is proportionate to the stated purpose. However, because the remote client/gateway are external and opaque, they could still request or relay sensitive data at runtime.

Persistence & Privilege

always:false and no special OS/config access — normal. Autonomous invocation is allowed by default; combined with dynamic code execution and an external gateway, this increases the blast radius if the remote package or gateway are malicious, but autonomous invocation alone is not a problem.

What to consider before installing

This skill appears to do what it says (wrap an on-this-day API) but relies on running an npm package from @latest and connecting to a third-party gateway. Before installing, verify the mcp-remote package and the gateway: check mcp-remote's npm page and source repository, prefer a pinned version (not @latest), and confirm the gateway.pipeworx.io operator and privacy practices. If you cannot audit the remote package or trust the gateway, avoid running this on agents with access to sensitive data or run it in a restricted/sandboxed environment. Additional useful information that would raise confidence: a pinned package version or a registry install spec, source repo and maintainer details for mcp-remote, or documentation showing the gateway simply proxies to byabbe.se without collecting extra data.

On This Day MCP — wraps byabbe.se/on-this-day (free, no auth). Free, no API key. Part of Pipeworx.

Tools

• get_events
• get_births
• get_deaths

Connect

{
  "mcpServers": {
    "pipeworx-onthisday": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/onthisday/mcp"]
    }
  }
}

More at pipeworx.io/packs/onthisday