MCP Integration

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill’s runtime path is MCP tool invocation over configured transports (SSE/HTTP/WS/stdio), where the MCP server can return arbitrary free-text content (e.g., tool results/descriptions) into the agent’s LLM context; for hosted/public servers this content is outsider-authored and not controlled by the operating user.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill documentation includes runtime connections to external MCP servers (e.g., SSE/HTTP/WS endpoints such as https://mcp.asana.com/sse, https://api.example.com/mcp, wss://mcp.example.com/ws) and an example stdio command that invokes npx @modelcontextprotocol/server-filesystem which fetches and executes remote code—these are used at runtime to register tools and execute remote operations, so they can directly control agent behavior.