connect-mcps

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs the agent to ask users to paste API keys and other secrets into the chat and shows examples where keys are pasted and then used for connection/testing and logged, which requires the LLM to receive and potentially output secret values verbatim (high exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The workflow explicitly performs runtime web searches (“I’ll search the web for …”) and then “extract[s]” documentation text from the search results; that fetched outsider web content can be ingested into the agent’s LLM context during parsing/extraction, creating an indirect prompt-injection risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly adds and queries external MCP server endpoints at runtime (e.g., instructing "claude mcp add --transport http [tool] [url]" and referencing PostHog hosts like https://us.posthog.com / https://analytics.posthog.com/settings), and those remote MCP responses are used to discover tools and automatically update routing/skill behavior — meaning external content can directly control the agent's prompts/instructions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes Payment Gateway integrations: it lists Stripe multiple times (e.g., "Priority Order: ... Stripe", "Setup: /connect-mcps connect to stripe", "PostHog, Stripe" examples, and a "Revenue Tools (Stripe, ChartMogul)" section). It guides collecting API credentials, adding an MCP endpoint, and discovering MCP tools for those services. Because Stripe is a payment gateway and is named as a target MCP (with instructions to connect and discover its tools), this skill provides a specific mechanism to integrate with a payment provider — which falls under Direct Financial Execution authority per the policy.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)