mobilerun-assistant-mcp

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill instructs the agent to read chat history, assistant replies, and user/assistant messages from the Mobilerun assistant MCP server, which can ingest assistant text and messages generated during task execution.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill talks to the Mobilerun virtual assistant via MCP, which can perform real tasks including browsing and using apps on a device, and mentions that assistant actions can create billed resources and require permission approvals (lines 17-20, 47-48, 177-179). Although these constitute direct/indirect operational tasks delegated to the assistant, authentication and session establishment are handled via API keys or OAuth sign-in (lines 32-35) with service API credentials and server access checks (lines 41-43), satisfying independent service authentication control. Thus, the operation is direct with qualifying independent access control.