byted-bytehouse-load-analyzer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The script scripts/load_analyzer.py explicitly starts an MCP stdio server that pulls code from a public GitHub URL ('git+https://github.com/volcengine/mcp-server@main#subdirectory=server/mcp_server_bytehouse') and then uses that runtime tool via session.call_tool, so untrusted public repository code and its outputs are fetched/executed and can directly influence the agent's tool behavior and decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The script launches uvx with the git URL git+https://github.com/volcengine/mcp-server@main#subdirectory=server/mcp_server_bytehouse at runtime, which will fetch and execute remote repository code as the MCP server dependency (thus running external code that controls the agent's tooling/behavior).