mcp-data-app

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the required runtime workflow, the deployed app’s template/server.py ingests outsider-authored HTTP request free-text from anyone who can reach the public /register, /authorize, and /token OAuth-shape endpoints (including form fields like client_secret and query/body fields like redirect_uri/state) and from /mcp tool-call traffic gated by the bearer key.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The pyproject lists the package "keboola-mcp-server @ git+https://github.com/keboola/keboola-mcp-server.git@v1.73.1", which is installed at container startup via the template's setup.sh (uv sync) and provides the imported keboola_mcp_server code that is executed at runtime, so a remote git URL is fetched and its code controls execution.