mcp-servers-essential-reference

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes examples that embed secrets verbatim (e.g., connection strings passed on the command line, an explicit "ghp_newtoken" export, and env vars placed directly in commands/configs), which encourage the agent to insert secret values into generated commands or configs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill repeatedly instructs running npx to fetch and execute remote MCP server packages at runtime (e.g., "npx -y @modelcontextprotocol/server-github" and similar @scope packages), which downloads and runs external code that directly provides/control agent tools (see server registry https://github.com/modelcontextprotocol/servers).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly lists and provides installation/config examples for money-moving MCP servers and APIs: Stripe (with STRIPE_SECRET_KEY and @stripe/mcp), Plaid, payment tools like PayPal/QuickBooks, Web3/blockchain servers (Base — "deploy contracts, send transactions"), and trading APIs (Alpaca with APCA_API_KEY_ID/SECRET and CCXT). These are specific, purpose-built integrations for payments, banking/finance, on-chain transactions, and market orders — i.e., tools whose primary intention is to move or authorize financial transactions. This meets the "Direct Financial Execution" criteria.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs installing and configuring MCP servers (running npx installs, editing user config files, adding services with credentials), includes commands that alter DB/system settings and create DB users, and enables access to high-risk infra (AWS, Kubernetes, Cloudflare, trading, web3) — all of which change the machine/agent state and can let arbitrary code or privileged actions run, so it poses a high risk.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)