native-mcp

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The MCP client design intentionally enables connecting to arbitrary external MCP servers (via subprocesses or HTTP), auto-injecting their tools into all conversations, and allowing server-initiated LLM requests and tool calls — creating clear avenues for remote code execution, data exfiltration, credential exposure, and supply-chain compromise if untrusted servers are added.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime path reads outsider-authored free text from MCP servers during startup discovery: it spawns configured MCP servers (stdio via command/args or HTTP via url), calls list_tools(), and later executes MCP tools whose responses (and any server-initiated sampling/createMessage content) are ingested into the agent’s LLM context; this includes arbitrary text authored by third-party MCP server operators.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill spawns runtime subprocesses that install/execute remote npm packages via npx (e.g., "npx -y @modelcontextprotocol/server-filesystem") and connects to remote MCP HTTP endpoints (e.g., "https://mcp.example.com/mcp") which can both execute remote code and invoke sampling/createMessage requests that directly control the agent's prompts.