Aiprox Workflows

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:12 AM UTC
• Version: 1.1.0

Overview

The skill is coherent for running paid AIProx workflows, but it asks users to run an unpinned npm MCP server with a spend token and sends workflow results to email or webhooks without enough safety guidance.

Install only if you trust AIProx and the npm package source. Use a tightly scoped, low-balance or revocable spend token, avoid sending secrets or regulated data through workflows, use only trusted email/webhook destinations, and prefer a pinned or otherwise verified MCP server version before using it for recurring paid automation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:108

Finding

Unpinned npm Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:108-109, 156
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

json

"command": "npx",
"args": ["aiprox-workflows-mcp"]

text

npx aiprox-workflows-mcp

Technical Analysis

The documented configuration executes aiprox-workflows-mcp through npx without specifying an exact package version or verifying its integrity. If the package is not already available locally, npx may retrieve and execute the package currently published under that name.

Consequently, the effective executable can change after this Skill has been reviewed. The project provides no lockfile, package integrity hash, trusted-registry restriction, or package-publisher verification. The MCP configuration also supplies AIPROX_SPEND_TOKEN to the spawned process through its environment at SKILL.md:109-112, increasing the sensitivity of the dependency boundary.

This finding does not establish that the current package is malicious. It identifies a supply-chain weakness through which a compromised or malicious future package release could be executed.

Attack Path

1. An attacker compromises the npm package, its publisher account, or the relevant package-distribution path.
2. The attacker publishes a malicious release under the expected package name.
3. A user follows the Skill instructions and starts the MCP server with npx aiprox-workflows-mcp.
4. Because no exact version or integrity value is specified, npx resolves and executes the mutable package release.
5. The malicious package runs with the operating-system privileges of the invoking user and can read environment variables exposed to the process, including AIPROX_SPEND_TOKEN.
6. It may misuse the token, access other resources available to the user, or execute additional commands within that privilege boundary.

Impact Assessment

Successful exploitation permits arbitrary code execution with ...[truncated 501 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the MCP package to a reviewed, exact version rather than resolving a mutable latest release:

   json

   "command": "npx",
   "args": ["--yes", "aiprox-workflows-mcp@X.Y.Z"]
   

2. Prefer a controlled installation process backed by a lockfile and npm integrity metadata, then invoke the verified local executable.

3. Configure npm to use an explicitly trusted registry and verify the package name, publisher, provenance, and release signatures where available.

4. Review package updates before changing the pinned version, including transitive dependency and integrity changes.

5. Use a narrowly scoped, revocable AIPROX_SPEND_TOKEN with strict spending limits.

6. Run the MCP server in an isolated environment with minimal filesystem, network, and operating-system permissions.

7. Avoid exposing unrelated secrets to the MCP process and establish a documented token-rotation procedure for suspected package compromise.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill prominently advertises delivery of workflow results by email or webhook but does not clearly warn that workflow inputs/outputs may be sent to external destinations outside the host platform. In a multi-agent workflow context, results may include sensitive prompts, summaries, scraped content, or derived analysis, so omission of this warning can lead to unintended data disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The authentication section shows a live credential pattern (AIPROX_SPEND_TOKEN) in configuration but does not warn users to keep it secret or avoid committing it to shared files, screenshots, or logs. Because this is a spend token tied to billable workflow execution, exposure could allow unauthorized use and financial loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The async execution section recommends using a callback_url to receive workflow results via webhook but omits a warning that outputs will be transmitted to an external service. This is especially risky in this skill because workflows aggregate multi-step agent outputs, which may contain sensitive source material, analysis, or operational metadata.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to run an MCP server via npx aiprox-workflows-mcp without pinning a specific package version. This creates a supply-chain risk because future or compromised releases could be fetched and executed implicitly, and the server is configured to receive a spend token capable of authorizing paid actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.