mastra

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill runtime workflow only discusses integrating an MCP client and lists tools/toolsets, but it does not itself specify reading any outsider-authored free-text feed/queue/ticket body that the LLM ingests without first selecting specific items.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill configures MCP servers that the agent connects to at runtime (e.g., new URL('https://my-mcp-server.com/sse')), and those SSE endpoints can deliver tool definitions that directly influence agent behavior, so the external SSE URL is a runtime dependency that can control prompts.