opfor-mcp-setup

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository contains an offensive MCP red-team framework with explicit exploit templates (command/code injection, SSRF including metadata access, OOB callbacks, resource reads like /etc/passwd, token/token-passthrough probes, secret-exposure and schema/description poisoning) that enable deliberate data exfiltration, remote code execution, and credential theft — high-risk dual-use tooling.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime flow includes connecting to the target MCP server and calling tools/list / resources/list, which ingests outsider-authored tool descriptions and resource metadata returned by the (user-selected) MCP server into the agent’s LLM context, enabling indirect prompt injection via tool/resource text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime steps and evaluators explicitly instruct fetching and using external web content and services (e.g., the LLM-injection test page "https://wuzzi.net/llm-injection.html" and OOB webhook URLs like "https://webhook.site/") as probe inputs that can contain adversarial instructions, and the stdio adapter examples also show launching remote packages via npx (e.g., "npx -y @modelcontextprotocol/server-filesystem"), which fetches and executes remote code at runtime — so external content/URLs are used during runtime and can directly control prompts or execute code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). Flagged because the skill instructs the agent to scan and launch local servers and to generate/run adversarial actions (read_file, write_file, delete_file, path traversal, SQL/command injection) that can read or modify files and processes on the host repository, enabling potentially destructive state changes even though it does not request sudo or create users.