jsreverser-mcp-javascript-reverse-engineering

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill autonomously navigates to arbitrary web pages and ingests page artifacts (e.g., navigate_page with arbitrary URLs, get_script_source/search_in_scripts, list_network_requests/collect_code) so it clearly fetches and interprets untrusted third‑party scripts and network content as part of its workflow (see the "Standard Workflow" and tool docs), which can materially influence subsequent hooks, breakpoints, deobfuscation, and automated actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The installation instructions explicitly clone and run code from the remote repository https://github.com/NoOne-hub/JSReverser-MCP.git (git clone → npm install → npm run start), which fetches external code that will be executed and is required for the skill to run.