mcp-hub

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow is to “browse available servers”/use an MCP marketplace (outsider public web content) and then connect to those MCP servers, which can cause the agent to ingest free-form text from external resources at runtime via the MCP tool outputs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's configuration invokes npx to run packages such as @modelcontextprotocol/server-filesystem (fetched from npm, e.g. https://www.npmjs.com/package/@modelcontextprotocol/server-filesystem) at runtime, which will download and execute remote code and thus is a runtime external dependency that can execute code.