configuring-connections

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill instructs creating/updating connections and iClients by supplying fields like clientSecret, passwords, tokens, and shows CLI patterns that require JSON payloads (e.g., create < connection.json, create < iclient.json), which implies the LLM would need to include secret values verbatim in generated payloads/commands if it were used to build those files or perform PUTs—creating an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The MCP connection schema requires a runtime serverURL (e.g. https://mcp-server.example.com/mcp) that the agent calls to invoke external MCP tools, so this URL is used at runtime to call/execute remote tools which can control the agent's behavior.