cowork-mcp-config-assistant

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt's example config explicitly shows embedding a personal access token value in a JSON config ("GITHUB_PERSONAL_ACCESS_TOKEN": "your-token-here"), which encourages placing secrets verbatim into generated files/outputs and thus requires the LLM to handle secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The SKILL.md instructs configuring MCP servers to connect to third-party services (e.g., "GitHub / GitLab", "Slack / Discord", "Google Drive / Notion" under "Configure MCP Servers") and explicitly tells you to "Verify: Test the connection by asking Tandem to list items from the tool," which means the agent will ingest and act on user-generated external content from those services.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs runtime use of an external MCP server (example: running "npx -y @modelcontextprotocol/server-github") and points to the MCP Registry at https://github.com/modelcontextprotocol/servers, meaning remote packages/repos would be fetched and executed at runtime.