aws-secrets-manager

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). asm-exec resolves {{resolve:secretsmanager:...}} by calling an outsider-controlled AWS MCP endpoint (https://aws-mcp.us-east-1.api.aws/mcp) via tools/call to aws___call_aws, which returns plaintext secret text that is then substituted into the command arguments/environment of the agent’s runtime flow.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill makes runtime calls to the AWS MCP endpoint (https://aws-mcp.us-east-1.api.aws/mcp), invoking the server-side "aws___call_aws" tool to run aws CLI commands and return secret values, so this external URL is required at runtime and effectively executes remote commands that control resolution of secrets.