mcp-builder

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow is the evaluation harness in scripts/evaluation.py, which reads the outsider-authored evaluation XML (eval_file) from disk and injects the <question> text into the LLM messages (messages = [{"role":"user","content": question}]), so any free text in that XML (authored by someone other than the operating user) becomes LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The evaluation harness connects at runtime to an external MCP server URL (e.g., the example shown "https://example.com/mcp") to fetch tool definitions that are passed into the model and to execute tool calls on that remote server, so remote content can directly influence agent behavior and run remote tool code.