vulnerable-mcp-servers-lab

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes hardcoded secret strings (e.g., "sk-hardcoded-secret-key-12345") and explicit test steps that instruct reading files, grepping env/logs, and scanning source for secrets—actions that require the agent to retrieve and potentially output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository intentionally contains multiple malicious and backdoor patterns (unsandboxed eval/exec, data exfiltration vectors, hardcoded secrets, fabricated/misleading tool outputs, typosquatted supply-chain examples, and network-accessible untrusted MCP endpoints) designed for abuse unless strictly isolated.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). This skill is a lab collection of multiple intentionally vulnerable MCP servers; at runtime, several of them (e.g., the “Indirect Prompt Injection (Local stdio)” and “Wikipedia (Remote HTTP Streamable)” servers) return outsider-authored free text (embedded malicious instructions in documents or fetched Wikipedia article text) directly into the agent’s LLM context via MCP tool responses like retrieve_document/get_article.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's setup instructs to git clone and run the repository at https://github.com/appsecco/vulnerable-mcp-servers-lab.git (git clone https://github.com/appsecco/vulnerable-mcp-servers-lab.git followed by npm install/node), which fetches remote code that is then executed and contains components (eval-based RCE, unsandboxed code execution and prompt-injecting servers) that directly control prompts and execute code at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running vulnerable servers and gives examples/tools for reading system files (e.g., ../../../etc/passwd), writing files outside the workspace, and executing arbitrary/un‑sandboxed code (Python eval/require('child_process').exec), which push the agent to perform actions that can modify or compromise the host system state.