mcp-mastery

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This skill explicitly instructs installing and using MCP servers that fetch and ingest open/public third-party content (e.g., Firecrawl, Browserbase, tavily/brave-search, GitHub, arbitrary URLs) and its "Task → MCP routing" and Tier 6 "Web scraping & extraction" entries in SKILL.md require the agent to read/interpret that untrusted content as part of workflow, so such content could materially influence tool use and actions.

---

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes install/runtime commands that fetch and execute remote packages (e.g., "claude mcp add --scope user filesystem -- npx -y @modelcontextprotocol/server-filesystem") and points to external GitHub repos such as https://github.com/modelcontextprotocol/servers, so remote code/servers would be fetched and executed at runtime and are required for the skill to function.

---

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill prompt for literal, high-entropy values that could provide access.

Flagged:

• supabase project_ref: "pzpaebzlwwmyhgwcjsge" — this is a high-entropy literal appearing in the "Actually connected" list as a project_ref for Supabase. It looks like a real project identifier/token stored in config and therefore should be treated as a secret (or at least sensitive config). If this is a live identifier that grants access or is tied to keys, treat it as leaked and rotate/regenerate.

Ignored (with reasons):

• "API_KEY=xxx" in the install example — placeholder ("xxx") and low-entropy; documentation example.
• "https://server.example.com/mcp" — example domain, not a secret.
• Environment token names like GITHUB_PAT, Sentry auth, CCI token, DB URL / Neon acct, Stripe secret key, Figma PAT, etc. — these are variable names or labels, not literal secrets.
• Other example placeholders such as "", "@latest", or items in tables — documentation placeholders.
• Any obvious sample/simple strings (none other high-entropy present).

Conclusion: Only the Supabase project_ref appears to be a direct, high-entropy literal value that could be an actual credential/config value.

---

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly lists and routes to a Stripe MCP server (Stripe secret key) and includes "Process a payment / refund" in its task→MCP routing. Those are specific payment gateway integrations (ability to send payments/refunds), which meet the direct financial execution criteria.