mastra-api-cli

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md’s required workflow includes running mastra api ... --schema and bounded live probes like mastra api ... log list ... | jq ..., which ingests outsider-authored free text from the target server’s responses (e.g., log messages, agent/tool definitions) into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill issues runtime requests to the target server (e.g., "$MASTRA_URL/api/system/api-schema" and various mastra api --url "$MASTRA_URL" agent/tool endpoints) and the doc explicitly warns that servers may return full agent/tool definitions including long instructions/schemas which can directly control agent prompts, so this is a runtime dependency that can inject instructions.