mcp-servers-reference

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes numerous examples and config templates that embed API keys/secrets directly (e.g., GITHUB_TOKEN="github_pat_xxx", STRIPE_SECRET_KEY=sk_test_xxxxx, AWS_SECRET_ACCESS_KEY=...), which would require an LLM to handle or output secret values verbatim when generating configs or commands, so it poses a high exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes setup commands that fetch and execute remote npm packages at runtime (e.g., "npx -y @modelcontextprotocol/server-github"), which downloads and runs external code as a required step to add local MCP servers.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly lists and documents servers that provide direct financial execution capabilities. Examples include payment gateways (Stripe with STRIPE_SECRET_KEY and warnings about creating real charges; PayPal with client credentials and sandbox/live modes), banking APIs (Plaid with client ID/secret and access to real banking data), trading/order APIs (Alpaca with API keys and the ability to place trades; CCXT configured for exchanges with API keys), and web3/blockchain servers that can sign/broadcast transactions or manage wallets (Base with RPC and signing, Solana with SOLANA_PRIVATE_KEY and ability to broadcast transactions, Thirdweb with secret key for contract/wallet management). The README also shows the exact environment variables and cautions that these servers can perform writes or execute transactions. These are specific, purpose-built financial tools (payments, banking access, order execution, blockchain signing), not generic interfaces, so the skill grants direct financial execution authority.