mcp-server-attack-probe

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The probe instructs the agent to enumerate and fetch sensitive resources (e.g., /etc/passwd, .env, ~/.aws, metadata endpoints, tool results/logs) and to confirm/report their contents, which requires the LLM to receive and potentially output secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The list mixes legitimate documentation and GitHub repos with several high-risk targets (169.254.169.254 metadata, loopback services 127.0.0.1:6379 and :11211, and attacker-controlled test hosts like evil.test and attacker-rebind.test) that are classic SSRF/DNS-rebinding abuse vectors — not direct malware download links but strongly suspicious for exploitation and credential/data exfiltration.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The prompt explicitly instructs the agent to enumerate and invoke filesystem and exec-style tools (including read/write with path-traversal like /etc/passwd and shell commands like "id") and to probe network/metadata endpoints, which empowers reading/modifying sensitive system files and executing commands on the host.